How to Visually Find Certified Professionals

booleanstrings Boolean 2 Comments

In Platonic philosophy, Anamnesis is the idea that humans possess innate knowledge (perhaps acquired before birth) and that learning consists of rediscovering that knowledge from within.

Sometimes, when I run into seemingly new sourcing methods, it seems like I knew them before and now remembered. Of course, part of it could be recalling a clever blog post in relation to the current challenge. 🙂

This just came up for me, in response to someone’s question about searching for AWS certification holders. Here is an approach that works great now, but didn’t 8-10 years ago (when I likely read about it) because fewer of certification logos were displayed anywhere.

Reverse-image-search using someone’s certification logo and find others:

Make sure to try Yandex reverse image search – it’s the top one currently.

If you still didn’t get the OLSD Digital Pass – stop procrastinating and make your work life easier and more fun! We had shared a zillion hacks like the above, the seven of us.

And if you are looking to attend a live event – there has never been an event better that Sourcing Summit Virtual, taking place July 6-9, 2020. (Trust me!) I will be presenting there.
Get your ticket at and please share with your colleagues!


Massive Discovery of Work Emails

booleanstrings Boolean Leave a Comment

Here is how to get hundreds of target email addresses in a short time without spending anything.

First, identify, by X-Raying the contact database, companies with a 100% format use. In my case, it is Healthcare companies in NYC. After I scrape a list from a Google search, it looks like this:

Now, if I know that someone with the right job title who lives in NYC, has over two years of experience, and works for one of these employers, I need to only have their name to be sure that I can reach them by email.

I search on LinkedIn for a Boolean OR of employers, which in my case looks like this:

I combine it with my target job titles = “registered nurse” OR “clinical research coordinator”, the NYC location, two-plus years of experience, and one-plus years at the current employer. For all these people, I am confident that they have a high chance to match and that I can reach them.

Here is one such search:

I have spent about two hours finding employers, scraping names, cleaning and manipulating data in Excel, built my string in our LinkedIn String Builder, scraped it for names and employers, and got 874 potential candidates I can reach with a close to 100% certainty. (Where else can you get that sort of ROI?) Now I can decide to either work outside of LinkedIn and email them or upload them to Recruiter and message from there. Note that I do not need to be on LinkedIn to email them.

Lesson learned, corporate recruiters: messing up your company email formats is an excellent way to retain employees! 😉 I haven’t seen this methodology mentioned before.

Get a recording of our workshop How to Find Anyone’s Contact Info for multiple demos addressing real-life requirements, including ways to reach out, and one month of online support on all your sourcing questions.



Boolean Strings for Building Email Lists

booleanstrings Boolean Leave a Comment

What follows is a how-to post.

Being short of InMails while sourcing in an industry, where those few who are on LinkedIn never open InMails, is a challenge. Emails have a better response rate and often, instant replies, at least in my experience recruiting Registered Nurses.

I am not going to talk about email-finding tools – there are plenty of informative blogs on that. I would like to expand on the concept of my last few posts.

If you have a list of email addresses, for many, you can find out who these people are professionally, filter down to your requirements, and contact for free.

For every new position I source, email collection is one of the first things I do after having gathered intelligence on terminology, job titles, companies, and anything relevant.

For the collection, I use two tools, both developed by my partner Julia Tverskaya, a Sourcer who codes, (who is in Wikipedia, by the way – how many of us are?):

1. Chrome Extension Email Extractor

The beauty of the tool is that it can follow you to every page you visit, collect emails from the source code, and keep adding to its list until you ask it to stop and copy to clipboard (make sure to mark that in the options). It has a superior extraction algorithm. The output list is deduplicated.

This morning, Julia has added two new useful options:

a) Alphabetize results

b) (Handy!) remove non-personal emails like [email protected], [email protected], [email protected], [email protected], etc. Anyone who has done email collecting knows that cleaning up lists is a headache, and it’s a big help.

2. Online Email Extractor

Paste your text, extract emails.

The reason I need both tools is that the extension doesn’t work on PDF files, so for them, I copy the full content, paste it into the second tool, and copy the output.

I merge and deduplicate the two lists.

Now, off to Google. I construct all sorts of search strings to capture emails right from results pages. Remember, any search would get no more than 300, maybe, 400 results, so variations are in order.

It is boring, but for the best outcome, you need to be methodical. (I am not, but I force myself.) Put on your favorite background music and sit in a comfortable chair.

Here are some string components I use to pull out emails from snippets, on most Google results. They are optimized for email addresses to be included in snippets.

As attractive as it may seem, do not use these substrings in OR combinations – use them individually for a much better outcome. Combine each of the terms with a variation of professional words, and keep the email collector running. If some of the results are PDF files, use the other tool. Notice every result that looks interesting based on its snippet and investigate the site.

There are some creative “exotic” searches you may think of that in practice do or don’t produce much. Anything is worth a try, though.

This list is far not exhaustive. Let me know of other good ones!

  • “” (this is “the king” keyword, so you may want to vary the other part of your search, such as job titles and locations, to find more)
  • “”
  • “”
  • “” (you can add other free domains if you want to be thorough)
  • “email me * *”
  • “me at * *”
  • “email * * com”
  • “email * * org”
  • “email * * edu” (do the same with country domains if you need)
  • “e-mail”
  • “email * * <company email domain>”
  • “email” “<company email domain>”
  • two company email domains
  • “” “<company email domain>”
  • -“at http” -“at www”  -“at https” “<company email domain>”
  • this one is exotic; however, it performs impressively well, depending on the company – email “david.*” I used the fact that many emails have the format [email protected]. Here, lovers of ORs, celebrate! If results are slim, it’s fine to include an OR of popular names in one string.
  • same as above but include one name and an OR of companies
  • and this is even wilder – I am now skipping the email domain altogether: email “david.*.*.com” healthcare.
    Here is what the results look like. The search can be narrowed down in various ways to continue producing new results.

The most productive are LinkedIn X-Ray searches since I can instantly reach the identified people with the knowledge of their professional background. The most volume comes from open-ended searches, with no sites specified, and X-Raying “interesting” sites that show up.

It also helps to add the words association, directory, and list – one at a time – to the string.

Note that you needn’t worry if you capture a school parent list or a basketball team roster. It costs nothing to keep emails, and filtering will remove false positives.

Tip: Don’t make additional, “professional,” part of the string too long because emails will stop showing up in snippets. Experiment, and you will see the right balance.

Any searches are useful, but it’s best to shoot for 100-300 results in each.

I am confident that this approach will significantly increase your outreach for any open position. It’s easy to follow; if you try it out, let me know how it works out. It is the easiest if you have a Recruiter subscription but y

If you are interested in other methodologies, get the recording of the latest Find Anyone’s Contact Info Workshop.







How to Find and Take Advantage of 100% Used Email Format

booleanstrings Boolean 2 Comments

We all know that contact-finding is a big deal in Recruitment.

I have recently started to pay attention to companies that have a 100% followed email format such as [email protected] Those companies are my friends! If I have an employee’s first and last name, I can confidently construct his or her email address.

I use this knowledge in two ways. (Note that I do utilize LinkedIn on the way but I don’t when contacting prospects).

1. For companies on my target list that are 100% email-disciplined, I collect first and last names of people with the necessary job titles, put them into Excel, and generate addresses with a formula.

LinkedIn is the easiest to search, but it has a tiny percentage of RNs, so I also Google, X-Ray Zoominfo, RocketReach, Facebook, specialized sites like Healthgrades, and association sites. It’s usually possible to collect thousands of records for a large employer and hundreds for smaller.

(Where and how to collect names is a separate matter and could fill more than one blog post. One way is to X-Ray a relevant site and scrape names from results. Facebook is also a great source.)

Once I have a list of names, I Excel-formula-generate everyone’s emails following the formats. There is always a need to brush up the input to be exactly first and last names, but it can be done in a few minutes. I dispose of records that don’t have both.

Now, for each person on the list, I have a choice:

a) InMail them from Recruiter, without spending InMail points (could be a better version for interaction tracking; doesn’t expose my company since the emails come from a LI return address). I tag the records on import to be able to locate them.

b) Email (could work better in deliverability – especially to Gmail – and response rate; better email tracking – see when emails are opened, for example).

I usually combine a) and b), especially for excellent matches.

2. I search on LinkedIn – or elsewhere – for the right titles and locations AND employees of these companies. I can then be sure for each person in the results what his or her work email is, and again can either “InMail-email” or just email.

In my current search for RNs in NYC and Indianapolis, two of many email-friendly companies are Mount Sinai Hospital and Eskenazi Health. If Jane Doe works at Eskenazi Health in Indianapolis, her email is [email protected].

I started wondering, how do I find other companies in my target industry or profession and location that also have a 100%-followed email format? I came up with a simple Google search that X-Rays RocketReach, a rich contact-finding database, and provides the answers. Here is an example search: being used 100.0% of the time “indianapolis” RN.

(To get most results, remember not to use OR in your queries. It is particularly important in these searches.)

Verify your results by Googling for email format <company name> before you proceed.

You can confidently reach thousands of potential employees in a few hours of work!

To learn high ROI sourcing techniques like this, I highly recommend signing up for the popular workshop Sourcing without LinkedIn coming up on Wednesday, June 17th. Seating is limited (and you know what that means!)

I will say more about the above technique in another post soon. 😉




Profile Export Hack in Recruiter

booleanstrings Boolean 1 Comment

LinkedIn loves its import. It lets us upload phone books, contact lists, resumes, salaries, identify professional relationships, job hunt preferences, company information, and more. Import has been the most reliable function in my experience with Recruiter.

But LinkedIn allows almost no export. Its PDF profile export loses part of profile information. No lists can be exported. It is a matter of major inconvenience for Sourcers.

To add to that, LinkedIn fights against scraping. More than one blog post has angrily called LinkedIn a “walled garden”. More than one tool had to shut down after a “cease and desist” from LinkedIn’s lawyers.

What I want to share is that I ran into a “better” profile export in Recruiter.

Instead of Saving to PDF, Print profile to a PDF file. That is it. The export does not only have more information, but it is also full of links. It even keeps a link to the original search. It’s a copy of the profile page. A PDF print of a profile looks like this:

Hope you like it 🙂

If you are a Recruiter subscriber, please join us at the upcoming webinar Mastering LinkedIn Recruiter on Wednesday, June 24 << Note the new date! You will not find the essential material we will cover in LinkedIn help or anywhere else. One month of support, limited seating.


Three Sites for Healthcare Sourcing

booleanstrings Boolean Leave a Comment

As I am running a recruiting project searching for Registered Nurses in NYC and Indianapolis, the main challenge remains. It is finding potential candidates’ contact information or ways to message.

Compared, for example, to IT sourcing, I am finding that the Social Media presence of RNs is much lower. However, the web is rich with all sorts of Healthcare-related lists. There are great directories of specialized RNs – like pediatrics, dialysis, or ER, but I need to find “just” RNs with two-plus years of experience. There are plenty of those, too.

  1. – a zillion directories by location and interest. There is no contact info but you can join, become friends, and message. Alternatively, X-Ray (but the results are limited):
  2. has a directory of the University of Michigan among others. No contacts but a nice level of detail and good coverage.
  3. – it’s a forum and members mention their emails in conversations. I found ~2K emails looking for posts from RNs, with a location mentioned, and the match on Recruiter was excellent.


Below is a list of State Boards of Nursing websites. On some, you can search and scrape, on others, you need a name to search. Typically, they would have the zip code, license number, and validity, and name, of course.




Two Sourcing Methods: “Backwards” and “Shooting In the Dark”

booleanstrings Boolean Leave a Comment

I have described the Backwards Method in the previous post. To summarize:

Step 1 – collect as many email addresses as possible from pages that may contain relevant ones. Get emails from Google results, pages containing contact lists, anything remotely promising. But probably keep your searches returning only results from the past 2-3 years since both emails and careers get changed fast.

You can get quite creative in Googling. Don’t forget to dig deeper into sites that promise more content judging on snippets.

It is not a problem even if your collection has 98% emails that are “wrong”.

Collect emails. No other info like names is required. Create an Excel File and paste the emails into the first column. Make the second column pass the test for “full names”. Put the full name as “a b” – it will work.

Step 2 – it is best if you have the “old” LIR. Upload the emails, 5K at a time. Tag uploads to search for them later.

Now, when you search for the tag(s) and your requirements, the results will be people whom you can directly email. No InMail points needed.

(If you do not have Recruiter, you can do cross-referencing with other tools and databases.)

That was the Backwards Method.

The Shooting In the Dark Method is similar, but Step 1 is extended further so to speak.

Step1 Advanced – Google for an expression that would point to an email, like a free email domain, or relevant companies’ email domains (also, try several at a time) AND your requirements like the job title and locations. Do not put any limitations on the type of pages. (But always keep an eye on the sites to explore.) Search for something as silly as

<job title> <location> “” “directory”

plus a few words to narrow it down to better results if necessary (perhaps, add another job title).

As I run the searches, I keep Julia Tverskaya‘s Email Extractor on in the background. I pause to gather and upload the emails in two cases: 1) the volume is getting close to 5K, 2) I am interested in the addresses from a particular source (so I may tag that upload to “View Insights”).

I won’t recommend running these open-ended searches as a solution for any project. But it’s worth testing what the picture is like for your opening. It has worked very well for me with one of our positions – Clinical Research Coordinator. I was able to figure contacts for a few dozen CRCs out of a couple of hundred LinkedIn members matching the requirement. It is far not everyone, but it didn’t take any time.

Googling this way is creative and fun 🙂


Contacting Registered Nurses

booleanstrings Boolean Leave a Comment

I am truly excited to be sourcing for COVID-19 Treatment trials. It’s like a dream come true! It is both helping and getting much deeper experience (and fun) sourcing in the Healthcare industry. We need to find:

in NYC and Indiana, several people for each of the four openings, and it’s urgent. Unlike in our typical sourcing projects, we also need to get potential candidates’ interest and screen them before submitting to the client, a Healthcare startup.

This project, naturally, poses the challenge of reaching out to massive numbers of people. Here are some solutions I am using. It’s not an exhaustive list, of course.

  1. As the first idea, when looking at someone’s profile, you can use some of the contact-finding Chrome extensions. Then, send an email. It “works when it works” but is somewhat slow – clicking on a bunch of tools takes time – and the success rate for these demographics is low.
  2. You can guess the work email based on the employer’s email format. I have done quite a bit of that. First, I pick the name of a particular employer, like a large hospital, and find the first and last names of its employees (RNs) by Googling and in other ways. I insert the names into Excel and run a formula to generate the emails according to the hospital’s email format (which is always easy to find). I have not tried mass-mailing to the auto-generated lists (and am afraid the bounce rate will be high), but I have uploaded them into LinkedIn Recruiter – and few point to members.
  3. It’s something I have been doing on various occasions and find to be productive. But when colleagues hear about it they shrug their shoulders (I don’t know why.) I have been talking about it, yet I know nobody who practices the technique except David Galley. I think I should give the method a name, for better recognition. Any suggestions?

Contact-Emails-Finding Method

Step 1. Google in various ways trying to catch some emails that might belong, in our case, to Registered Nurses in NYC. I simply Google for job titles, locations, and something like “”, or “email me at *” examining websites that sound promising – for example, look like attendee lists based on the snippets. If I find a “good” file, I X-Ray the site for more files like it and “see what I can do” on the site itself. To speed the gathering up, I use our Email Extractor that follows me from one page to another, appending scraped lists.

The goal is to collect as many emails as possible. As long as some of those are “ours”, it doesn’t matter that the rest point to the wrong professionals. Their deliverability also does not matter. Any other info including first and last names is not required.

Step 2. I cross-reference the list against LinkedIn using Recruiter import (I am glad we have the “old” version again). I tag all imported records to be able to find them later. Then, I run Recruiter searches with our target locations and job titles. For the profiles identified, I can now message them in Recruiter without spending the points (which I usually do, to record the activity) or email. After cross-referencing, I can be confident the outreach messages are relevant. If you are curious about the numbers, it depends, of course, but after I spend fifteen minutes collecting and uploading lists, I get about a dozen matches for both RNs and CRCs.

There is a way to cross-reference email lists with a basic account, as well!

There are other tools and databases for cross-referencing email lists that I sometimes use, but doing it with LinkedIn would produce results for sure. It would be very far from a complete list, but we only need to find so many.

(By the way, in its help, LinkedIn mentions the possibility of cross-referencing with phone numbers but I have never seen it working.)

There is a lot more to say about the topic. For example, I have found endless scrapable directories of Healthcare professionals, often, with contacts, and now have gigantic lists to utilize. I’ll write about some discoveries in future posts. We have also long wanted to deliver a Sourcing webinar for the Healthcare Industry and now are getting the right experience. It’s better to teach what you practice, right? 😉

So in this case, I spend most of my time outside of LinkedIn and only go there to look up the contacts I find elsewhere or use other tools to find additional prequalified professionals. At that point, I already have their contact emails.

Many of the ways we apply in the COVID project are ways to source on the web that work across industries – and source mostly outside of LinkedIn since (for us) has a tiny fraction of our population. It’s not too early to sign up for the popular Sourcing without LinkedIn Workshop. If you do, make sure you bring concrete challenges to see them addressed in demos.

How Many Results Do You Wish to Get?

booleanstrings Boolean Leave a Comment

There is always a limit on the number of search results you can view. It is 1,000 on LinkedIn with any account. On Google, you will not get more than 300-500 results for any search.

If you are a “perfectionist” and always want to see as many results as possible (and maybe with the Verbatim filter), sorry, you are wrong.

For the majority of Google searches, sourcers, as everyone, look just for one, maybe 2-3 top results. We need these searches to gather Competitive Intelligence:

In other types of searches, where you want to see as many results as possible (for example, as many public profiles from a social site as possible) – append &filter=0 to your search URL. You will get more results from each site.

However, remember that the number of search results Google shows is always misleading. You will not get to see more than 300-500 results for any search – even if it shows the number in the millions. The number may change as you go through the pages of results. It may change “the wrong way” if you use Boolean logic on large result sets. Bottom line, ignore the number 😉

Check out my full presentation on Google along with five other recordings on all topics sourcing from seven international practitioners and speakers at our Online Sourcing Learning Day.