EMAIL & USERNAME INTELLIGENCE

An email address is not just a contact. It is a clue — and personal data. Treat it like evidence, not a toy you feed into every box on the internet until something beeps.

Why this matters

Email is still the hinge between "a person on a platform" and "an organisation, a provider, a history." The local part leaks naming habits. The domain leaks employer or disposable intent. Public pages still reprint addresses like it is 2009. If you cannot parse an address before you pivot, you will spend an hour investigating a Mailinator leftover and call it tradecraft.

What you'll be able to do

You will split an address into local part and domain, classify type (personal, work, custom, disposable), extract name or handle clues without inventing a biography, and run a public validation pass. HIBP in this module is for *your own* addresses. No credential stuffing. No inbox break-ins.

An email address is not just a contact. It is a clue.

Every email address contains structure, provider hints, and sometimes the person's name, handle, or employer. Structure is the part you can defend. "This local part looks like a 1987 birth year" is a hypothesis. "This domain is the company's public mail domain" is a fact you can check.

Read the address before you search it. Students who paste first miss plus-tags, role accounts (info@, press@), and the difference between j.smith and john.smith.contractor.

Parts of an email address

• **Local part** (before @): May contain name, initials, birth year, or a handle.
• **Domain**: Reveals email provider, company, or custom domain.
• **Plus addressing**: Some providers treat name+tag@domain.com as the same inbox — useful for tracking who sold your data.

Plus addressing is a gift when *you* used it. name+newsletter@ is a tag, not a second human. Gmail often ignores dots in the local part; the web may still store the dotted form. Role locals (hr@, billing@) are functions, not faces.

What the domain tells you

• **Gmail / Outlook / Yahoo**: Personal addresses, harder to trace. High volume, high collision. The local part does more work here.
• **Company domain**: Likely work address — reveals employer. Confirm the domain is actually the organisation's mail domain (MX, public staff pages), not a lookalike.
• **Custom domain**: Self-hosted or small business. WHOIS the domain for more — registrar, creation date, sometimes a privacy redaction that still leaves a pattern.
• **Disposable providers** (Mailinator, 10MinuteMail): Likely throwaway, low signal.

University and government domains behave like company domains with more public directories. Check whether a "new webmail" brand is real or a Gmail lookalike.

An email address that leads to a dead disposable domain is usually not worth the effort. Move on to higher-signal sources.

Quick email validation

Before investing time investigating an email, check if it exists — *as a public fact*, not by trying passwords.

• **Emailhippo** or **Hunter.io**: Format checks. SMTP "exists" results are often wrong. Treat them as clues, not proof an inbox is live.
• **Have I Been Pwned**: In this course, run it on **addresses you own**.
• **Google search** in quotes: The main pivot — bios, PDFs, press contacts. Record the page, not just "it exists."

Numbered workflow

1. Parse local part, domain, and any plus-tag. Write likely type.
2. Note name/handle clues as hypotheses, not facts.
3. WHOIS or otherwise identify a custom domain if present.
4. Quoted web search for public mentions. Save URLs.
5. If the address is yours, check HIBP and note breach names and data classes — not passwords.
6. Decide: enough signal to continue, or stop and pick a better identifier.

Legal and ethical boundaries

Public correlation only. You may search what the open web already shows. You may check *your* addresses on HIBP. You do not stuff credentials, you do not buy "inbox access," and you do not run other people's mail through every breach kiosk because you are curious. Validation is not intrusion.

Common mistakes

Assuming Gmail local parts are unique people. Treating info@ as a CEO. Spending a session on a disposable domain. Using a "does this mailbox exist" tool as proof of identity. Checking strangers on HIBP "for practice."

**Rule of thumb:** An email address is a label, not a confession. Parse it, search what is public, and resist the urge to see if the password still works. That urge is how careers end.

Close with the exercise: take five email addresses from *public* sources and analyse each one: provider, likely type (personal/work), any name clues in the local part, and any domains you can WHOIS. Leave HIBP for addresses you own, in the breach lesson.