Home/Email OSINT

🕵️ OSINT Email Investigator

Enter any email address for deep intelligence: breach database check (k-anonymity — password never sent), MX record validation, disposable email detection, email provider identification, plus-address analysis, and permutation generation for OSINT investigations.

🔒 Breach check uses k-anonymity — only first 5 characters of the SHA-1 hash are sent to HIBP. Your full email is never transmitted.

Privacy & k-Anonymity

The breach check uses Have I Been Pwned's k-anonymity model. Your browser computes a SHA-1 hash of the email, then only the first 5 characters are sent to HIBP. The server returns all hashes starting with those 5 characters and matching happens locally — your full email is never transmitted to any external service.

OSINT Email Investigation: Breach History, MX Records, and Digital Footprint Analysis

The OSINT Email Investigator performs comprehensive open-source intelligence (OSINT) analysis on any email address. Enter an email and the tool queries multiple public databases to determine whether the address has appeared in known data breaches, checks the domain's mail server configuration, verifies whether the mailbox exists without sending a message, and maps any public digital footprint associated with the address.

Data breach lookups use the k-anonymity model to query the Have I Been Pwned (HIBP) database without ever transmitting the full email address — only a SHA-1 prefix is sent, protecting the privacy of your query. If the address appears in known breaches, the tool lists which breaches and what data was exposed (passwords, phone numbers, physical addresses, etc.).

The domain analysis module examines MX records, SPF configuration, and SMTP server characteristics to determine whether the domain is a legitimate business, a disposable email provider, or a known spam infrastructure. This intelligence helps distinguish real contacts from throwaway accounts.

⚡ How to Use

  1. 1Enter the email address you want to investigate in the input field.
  2. 2Click "Investigate" — analysis runs across all OSINT modules simultaneously.
  3. 3Check the breach history first: any breach exposure requires immediate attention.
  4. 4Review the domain analysis for MX records and disposable email provider detection.
  5. 5Examine the SMTP validation result to confirm whether the mailbox actually exists.

🎯 Who Uses This

  • ▸Security teams checking if corporate email addresses have been exposed in breaches
  • ▸Individuals verifying whether their personal accounts have been compromised
  • ▸Hiring managers performing due diligence on submitted contact information
  • ▸Fraud investigators researching suspected fraudulent contact addresses
  • ▸Journalists investigating sources and their digital trail

Frequently Asked Questions

Q: Is the email address transmitted to any external service?
The breach lookup uses k-anonymity: only the first 5 characters of the SHA-1 hash of the email are sent to the HIBP API. The actual email address is never transmitted. All other analysis (MX lookup, SMTP check) uses the domain portion only.
Q: What is a data breach?
A data breach occurs when unauthorized parties gain access to a company's user database and exfiltrate the data. Breached databases containing email addresses, passwords, and personal information are subsequently sold on dark web markets and indexed by services like HIBP. Knowing your email is in a breach means you should change your passwords immediately.
Q: Can SMTP validation tell if an inbox exists without sending email?
SMTP validation connects to the domain's mail server and issues an RCPT TO command without completing the delivery. Many mail servers respond with whether the address is valid. However, catch-all servers (which accept mail for any address) will always return positive, and some servers block this verification technique entirely.