An email address is one of the strongest identifiers you can get: it is unique, people keep it for years, and most services use it for sign-up. This playbook covers two common cases:
- A suspicious message (phishing, fraud, harassment): where did it really come from?
- An address of interest: which services is it registered with, and what else does it lead to?
Steps
Tools used (ot guide tools osintverse-community/email-investigation installs them all):
| Tool | Used for |
|---|---|
| osintverse-community/email-header-parser | Senders, relay hops, IPs and authentication results |
| osintverse-community/checkdmarc | The domain's SPF, DMARC and MX setup |
| osintverse-community/dns-records | The domain's other DNS records |
| osintverse-community/holehe | Sites where the address has an account |
| osintverse-community/socialscan | Accurate checks on major platforms |