Email OSINT: how to investigate an email address
An email address is one of the most useful starting points in open-source intelligence. People reuse them for years, sign up for everything with them, and rarely think of them as public. This guide covers what you can learn from one, in the order an investigator usually works.
Read the address itself
Before you search anything, the address has already told you a few things.
- The provider. A Gmail, Outlook, Yahoo or iCloud address is a personal account. An address on a company or university domain ties the person to that organisation, at least when it was created.
- The local part. Patterns like firstname.lastname, initials or a birth year often carry a real name. A handle like darkwolf_88 is more likely a username the person uses elsewhere.
- Disposable domains. Throwaway providers exist to receive one message and vanish. An address on one tells you the sender did not want to be found, and it will rarely lead anywhere.
- Plus addressing. Many providers deliver name+anything@ to name@. Strip the tag before you search, and note it: the tag often names the site the address was given to.
Search engines
Search the full address in quotation marks on more than one search engine. Results differ, and each indexes pages the others miss. Look for forum posts, old mailing-list archives, documents, CVs, conference programmes and company pages that list contact details.
Then search the local part on its own, in quotes. If the address is darkwolf_88@…, the handle darkwolf_88 may appear on its own on sites where the address never does.
Accounts linked to it
Most platforms are signed up for with an email address, and many will show a profile for it. Checking platforms one by one is slow, so an email lookup that covers many at once is the fastest way to see where an address is used. The SearchEmail lookup checks 100+ platforms in one search and shows each account’s picture, name and username.
Read the accounts together rather than one at a time:
- Do the names agree? One real name across several platforms is a strong lead.
- Is the same picture reused? That is often stronger evidence than a name.
- How old are the accounts? Long-lived accounts are hard to fake in a hurry.
- What kinds of platforms are they? Fitness, developer and work tools each say something different.
Breach records
Breach notification services tell you whether an address appears in known data breaches. That matters in two ways. For your own address, it tells you which passwords to change. In an investigation, a breach shows that the address existed and was in use at a given date, and the name of the breached service can be one more platform the person used.
Have I Been Pwned is the best-known free service for checking your own address. Seer searches breach records and stealer logs by address, username or domain, and the SearchEmail lookup counts an address’s breach records alongside its accounts.
The domain
For an address on a custom domain, the domain is its own source.
- The website. Visit it. A business site may list staff; a personal site may be the whole answer.
- Registration records. Look the domain up in a WHOIS or RDAP service. Many records are now privacy-protected, but the creation date, registrar and name servers are public, and older records sometimes are not redacted at all.
- Mail records. The domain’s MX records show which provider handles its mail, such as Google Workspace or Microsoft 365. A domain with no mail records is usually not set up for email at all, which is a sign that an address on it may not be real.
Message headers
If you received a message from the address, open its full headers (“Show original” in Gmail, “View message source” in Outlook). The Received lines trace the servers it passed through, and the authentication results (SPF, DKIM and DMARC) show whether the message really came from the domain it claims.
Large webmail providers usually hide the sender’s own IP address, so headers rarely locate a person. They are very good at exposing spoofed senders, which is often the question that matters.
Profile pictures
A profile picture found through an address can be searched in reverse image search engines. The same photo on other sites can reveal accounts under different names. A stock photo or an image lifted from someone else is a warning sign about the account itself.
Pivoting to usernames
Each account an address opens usually has a username. People reuse usernames far more than they reuse addresses, so each one is a new search across hundreds of platforms where the address itself may never appear. Seer searches usernames across 740+ platforms.
Keeping a record
Profiles change and disappear. As you go, note what you found, where, and when, and save screenshots or archived copies of pages that matter. A finding you cannot show later is hard to rely on.
Staying on the right side of the law
Looking at what people have made public is legal in most places. What you do with it is not always. Do not contact, harass, impersonate or track the person, do not try to sign in to their accounts, and in the EU and UK remember that collecting personal data for your own purposes can bring data-protection duties. Investigate to protect yourself, your organisation or people at risk, and stop when you have the answer you needed.
Need more than an email lookup?
SearchEmail is a free tool from Seer, the OSINT platform behind it. Seer opens the details locked here, and searches the same person by username across 740+ platforms, by phone number, and through breach records, stealer logs and US public records.
Try Seer’s free check- Social account searchEmails, usernames and phone numbers resolved to live accounts, with every detail the profile shows.
- Breached credentialsWhich breaches an email address appears in, and what leaked with it.
- Stealer logsLogins captured by malware on infected devices, searchable by email, username or domain.
- Plans and pricingWhat an account adds to the free check, and what it costs.