Twitter Profile Email Scraper — X / Twitter Profiles and the Addresses On Them

Search X / Twitter by keyword, verify every address, and get a record per account — not a flat list where eight rows turn out to be the same shop.

---

What it does

1. Every address is checked before you see it

Every address goes through the same checks:

Check	What it answers
Syntax	Is this actually an address, or a fragment like logo@2x.png?
MX records	Does the domain publish mail servers and accept mail at all?
Role mailbox	Is this info@/sales@/support@ — a desk rather than a person?
Free provider	Gmail, Outlook, Yahoo and several hundred others
Throwaway inbox	Known disposable-email providers, plus the public blocklist
Confidence	A 0–100 score combining all of the above

Filter on any of them: minimumConfidence, excludeRoleAccounts, excludeFreeProviders, excludeDisposableEmails, requireMxRecord.

requireMxRecord drops addresses whose domain has no MX record and those where the lookup could not be completed — an unknown result is not evidence that a domain accepts mail.

2. One inbox is counted once

De-duplication is on the canonical inbox, not the raw string. J.Smith@Gmail.com, jsmith@gmail.com and j.smith+news@gmail.com are one Gmail inbox and are returned once.

3. The X / Twitter profile behind each address

The result link is parsed into the identity behind it:

• profileHandle — the account name
• profileType — what kind of page it is
• profileUrl — a canonical link to the profile
• platformName / platformHost

For example https://twitter.com/jack becomes handle @jack of type profile.

4. One record per account, not per address

A profile with three addresses is one account you can approach three ways. Alongside the address rows, the run emits a profile record per account:

Field	Meaning
profileHandle / profileUrl / profileType	Who the account is
addressCount / addresses	Every address found on it
namedContacts	The ones that look like a person rather than a desk
departmentsReachable	sales, support, executive, …
companyDomains	The company domains behind the addresses
bestContactEmail	The highest-confidence address on the account
profileReachability	0–100: how easy this account is to approach

Turn it off with emitProfileRecords: false.

5. Which query templates earned their cost

The run summary reports pages scanned, results seen and addresses returned per query template, plus searchPatternsWithNoLeads. Every row carries the searchPattern that found it.

---

Input

Field	Type	Default	What it does
keywords	array	—	What to search for
country	string	United States	Which country's results to search
emailType	string	B2C	B2B returns company domains, B2C returns free-provider addresses
maxEmails	integer	20	Stop after this many
verifyEmails	boolean	true	Run the checks above
minimumConfidence	integer	0	Drop anything scoring lower
excludeRoleAccounts	boolean	false	Drop info@, sales@, …
excludeFreeProviders	boolean	false	Drop Gmail, Outlook, …
excludeDisposableEmails	boolean	true	Drop throwaway inboxes
requireMxRecord	boolean	false	Only domains that accept mail
useDisposableBlocklist	boolean	true	Load the public throwaway list
includeResultSnippet	boolean	true	Keep the text each address was found in
emitRunSummary	boolean	true	Append the totals and the template report
emitProfileRecords	boolean	true	Append one record per profile

---

Output

{
  "recordType": "profile",
  "platform": "X / Twitter",
  "profileHandle": "@jack",
  "profileType": "profile",
  "profileUrl": "https://twitter.com/jack",
  "addressCount": 3,
  "addresses": [
    "j.doe@acme.com",
    "sales@acme.com",
    "support@acme.com"
  ],
  "namedContacts": ["j.doe@acme.com"],
  "departmentsReachable": ["sales", "support"],
  "companyDomains": ["acme.com"],
  "bestContactEmail": "j.doe@acme.com",
  "bestContactConfidence": 95,
  "profileReachability": 95,
  "searchKeywords": ["fitness"],
  "sourceUrls": ["https://twitter.com/jack"]
}

A final summary record carries the run totals, the category breakdown, the top email domains and the per-template report.

---

Good to know

• This searches a public search engine for pages on X / Twitter. It reads what is publicly indexed; it does not sign in to X / Twitter and cannot see anything private.
• Only addresses that are already public are returned. Nothing is guessed, generated or pattern-matched from a name.
• Verification is a DNS check, not a mailbox check. hasMxRecord says the domain accepts mail. It cannot say a specific inbox exists.
• Coverage depends on what is indexed. An address that appears nowhere in a public search result will not be found.
• Contact your prospects lawfully. Under GDPR, CAN-SPAM and similar rules you need a lawful basis for unsolicited contact, and the fact that an address is public is not on its own that basis.