Email OSINT tools: where an address is registered and what its headers say
Free tools on the registry that check where an email address is registered, find related addresses, and read a message's headers and domain.
To check where an email address is registered, run ot run osintverse-community/holehe e:someone@example.com:
holehe asks 120+ sites whether the address has an account, in ways that don’t alert its owner, and lists the ones
that say yes. user-scanner covers 2,700+ sites and socialscan a shorter list of major platforms. When you have a
message rather than an address, email-header-parser reads its headers without going online, and checkdmarc and
dns-records check the domain it came from. None of these needs an API key, and all of them run with the same
command shape and save their results the same way.
Where an address is registered
holehe checks 120+ sites and prints the ones where the address is in use. On sites with a forgotten-password function it sometimes shows a partly masked recovery phone number or address too. On our test machine it checked 121 sites in 13 seconds.
ot run osintverse-community/holehe e:someone@example.comRun against example@example.com, holehe reported 13 sites with an account. That is the first thing to know about
these results: a hit says an account exists with that address, not who made it, and many services let anyone sign
up with an address they never verify.
user-scanner checks 2,700+ sites and services, for a username or an email address. A full run usually takes about three minutes.
ot run osintverse-community/user-scanner e:someone@example.comsocialscan covers fewer platforms but uses their own availability checks. It
takes a username or an email address as one input called query:
ot run osintverse-community/socialscan --query someone@example.comIn our test run it answered for eight platforms in under three seconds, and two of the answers were rate-limit
errors. Two things to keep in mind when you read any of them, from the
email investigation guide: a rate limit shows up as an error
(holehe marks it [x]), not as “not registered”, so run it again later rather than treating it as a negative; and
masked recovery details can be compared with identifiers you already hold, but never unmasked through the site’s
own recovery flow.
Checks that don’t notify the owner
A package’s manifest can say whether the person you are looking into could notice a run (notifies_target), and the
tool page shows it next to whether the tool contacts the target, logs in to accounts or returns personal data:
- holehe declares that it does not notify the target.
- user-scanner declares the same, and its manifest explains how: the modules that may send the account owner an
email or alert are skipped, because the package never passes
--allow-loud. - hibp-breaches and hunter-domain-search look the address or domain up in a provider’s own database, and declare that they don’t notify the target either.
None of the tools in this post contacts the target directly. What does alert an owner is going further by hand: starting a password reset to see the masked recovery details in full sends them an email.
Other addresses for the same person
- mailcat takes a nickname without the
@domainand checks which of 25+ mail providers have an address with it:ot run osintverse-community/mailcat u:janedoe. Add--provider protonto check one provider. - osgint takes a GitHub username and finds the email addresses in that person’s commits, with their public SSH and GPG keys. It uses GitHub’s unauthenticated API, which allows 60 requests an hour per IP address.
- theharvester collects addresses, subdomains and hosts for a domain from public search engines and datasets. By default it uses only sources that need no key.
- hunter-domain-search lists the addresses Hunter has found for a domain, with names, positions and the address pattern. It needs a Hunter key; a free account includes a monthly allowance.
- hibp-breaches lists the breaches an address appears in, with the date and the kinds of data exposed, never the data itself. It needs a paid Have I Been Pwned key.
When a tool needs a key, ot names it and where to get one, and ot keys set HUNTER_API_KEY keeps it in your OS
keychain.
What the headers say
For a suspicious message, copy its full headers (in Gmail, Show original; in Outlook, File, Properties,
Internet headers) into headers.txt and run
email-header-parser:
ot run osintverse-community/email-header-parser --headers "$(cat headers.txt)" -f tableIn Windows PowerShell, use --headers (Get-Content -Raw headers.txt). The tool runs with no network at all, so the
headers never leave your machine. For a short sample message it printed:
TYPE VALUE SOURCE CONFIDENCE
domain example.org email-header-parser high
domain example.net email-header-parser high
email accounts@example.org email-header-parser high
email billing-desk@example.net email-header-parser high
ip 93.184.216.34 email-header-parser highEach entity records the header it came from. Here the From address is at example.org but Reply-To is at
example.net, so replies would go somewhere else: a free-mail Reply-To on a company’s From is a classic fraud
pattern. Without -f table, the JSON result also holds hops, the servers the message passed through with their
times, oldest first, and auth, the SPF, DKIM and DMARC results. A DMARC fail from a domain with a strict policy
is a strong sign of spoofing, and the first public IP in the hops is often the sender’s mail server.
The domain it came from
The part after the @ tells you who runs the mailbox: a free provider, a company, or a domain someone registered for
the purpose.
ot run osintverse-community/checkdmarc d:example.com
ot run osintverse-community/dns-records d:example.com --types MX,TXT,NScheckdmarc reports the domain’s SPF, DMARC, MX, BIMI and DNSSEC records and what
is wrong with them. For example.com it found v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s, an SPF record of
v=spf1 -all, and a null MX record, which means the domain accepts no mail at all, so a reply would bounce. No
DMARC record, or p=none, means anyone can send as the domain and most receivers will accept it.
dns-records lists the raw records; TXT records often hold verification tokens
that show which services an organisation uses.
All of it at once
ot playbook email-investigation e:someone@example.com d:example.comThe bundled playbook runs holehe and user-scanner on the address, and checkdmarc and dns-records on the domain, and
saves every run under one case. ot guide read osintverse-community/email-investigation opens the full guide in the
terminal, and every tool that takes an email address is listed on one page. For the username in the
address’s local part, see username search tools.
More posts · Changelog · This post as Markdown