A
MODULE_DEPLOYED // EMAIL-OSINT

EMAIL & USERNAME INTELLIGENCE

Trace email addresses and usernames across platforms to build identity profiles and connection maps.

BEGINNER

EST_TIME: 3-4 HOURS

PHASES: 3

SYNC_PROGRESS0 / 3 PHASES COMPLETED (0%)
MISSION_PHASES
1
EMAIL ADDRESS ANATOMYDURATION: 20 min
2
USERNAME CORRELATIONDURATION: 35 min
3
BREACH DATA AND PIVOTINGDURATION: 30 min
OPERATIONAL_DATA
EXTRACT_RESOURCES
PHASE_001 // CURRENT_OBJECTIVE
EMAIL ADDRESS ANATOMY
NODE: 1 / 3

An email address is not just a contact. It is a clue.

Every email address contains structure, provider hints, and sometimes the person's name, handle, or employer.

Parts of an email address

  • **Local part** (before @): May contain name, initials, birth year, or a handle.
  • **Domain**: Reveals email provider, company, or custom domain.
  • **Plus addressing**: Some providers treat "name+tag@domain.com" as the same inbox — useful for tracking who sold your data.

What the domain tells you

  • **Gmail / Outlook / Yahoo**: Personal addresses, harder to trace.
  • **Company domain**: Likely work address — reveals employer.
  • **Custom domain**: Self-hosted or small business. WHOIS the domain for more.
  • **Disposable providers** (Mailinator, 10MinuteMail): Likely throwaway, low signal.

Quick email validation

Before investing time investigating an email, check if it exists:

  • **Emailhippo** or **Hunter.io**: Verify if the address format is valid.
  • **Have I Been Pwned**: Check if the address appears in known breaches (useful for pivoting).
  • **Google search** in quotes: See if the address appears on public pages.
An email address that leads to a dead disposable domain is usually not worth the effort. Move on to higher-signal sources.