Sometimes you receive emails from strange addresses and you want to find out who this email account is. We can use the OSINT method to analyze and investigate the origin of the received Email. You can start from publicly available data sharing sources. The goal could be to find as much information about the target’s email as finding out what websites have signed up for an account with that email and what that means for the target. This article will introduce the top 5 OSINT websites when working with email addresses.
Top 5 OSINT Sites to Collect Email Crawling
1. Epieos
Epieos is an account finder that helps to find Email account holders without notifying the user. Once you enter an email and complete the captcha, you’ll get results on where that email was used. In the example below, it shows that the email searched has accounts on Twitter, Spotify, Nike, Google, Eventbrite, and Amazon sites. As an OSINT person, you should try to find out more about these accounts by using a search engine or by going directly to the website.
Eg:
OSINT paths:
- Find where to register an account with that email
- Turn around that information to find more data about that account and user, for example if a user has reviews on Google Maps it could reveal connections to other people or businesses.
- If there is an image in the Epieos results, right click and open in a new tab to see a larger image
- Reverse that image search to see where the photo is
2. Skype
Skype searches through the Skype App and finds not only the Email account holder, but also the name, username, and phone number if they are associated with a Skype profile. As in the example below, I search for an email and find the profile associated with that email.
Eg:
Search the email and find the associated Skype profile.
Skype username and date of birth.
OSINT paths:
Searching for an account associated with a target may reveal information that helps in building a profile about the target:
- profile name
- Profile photo
- account name
- Birthday
- Address
3. Whoxy
Whoxy is a website involved in some WHOIS related searches. My favorite feature is the reverse WHOIS lookup to find the web pages associated with the email address. Note that reverse WHOIS can also show historical information, but not always, so it’s important to verify your findings. In the example below, from the search drop-down select “email address”, enter email and click search. The results show a web page associated with that email address. This is where you will conduct your research and who can link to it. If the site is no longer available, I recommend searching Wayback to see if the site is backed up there.
Eg:
OSINT paths:
- Find websites associated with the target email
- Rotate the site information to find more data about it.
- Use Wayback to find web pages.
4. HaveIBeenPwned
HaveIBeenPwned is a website to check if an email or phone number has leaked passwords. In the example below, I entered the email address of the target and discovered there were 9 data breaches related to this email address. The results indicate that platforms like Dropbox, Epik, and LinkedIn tell us this target has registered on these platforms.
Eg:
Results from HaveIbeenpwned.com
OSINT paths:
- Find where the registered email address is.
- Turn around that information by looking on those platforms to find more information about the target.
5. That’s Them
That’s Them is a tool for finding people in a variety of ways, including by email address. Results can vary from detailed targeting or minimal information where the site redirects to a service that wants you to pay for search results. I didn’t use the paid method because I often see useful results in the free version. Common results include: the email owner’s name, location, and phone number. Remember that these results are for those in the United States.
Eg:
Results from Thatsthem.com
OSINT paths:
- Find the name of the user’s email address.
- Find location, phone number and other important details related to email address.
- Revolving around that information means getting the information and searching in other places like Google and Bing.
In addition to the 5 sites above, there is still another place full of memories, Space. A lot of people still have profiles on that platform, so sometimes you can find someone’s old profile, if they subscribe to a profile, and sometimes you can also find posted photos and connections with everyone.
Type the following URL in your browser: https://myspace.com/search/people?q=emailhere@gmail.com
and replace “emailhere@gmail.com” with the target email address.
Eg:
Photos from MySpace related to the searched email address.
Connect with people on this MySpace profile.
Regardless of the OSINT engine we use, it’s important that you have a good understanding of the OSINT tools you use and how they work.
It would be helpful if you organized your OSINT stuff. You can sort by data type like email addresses, phone numbers, etc. That way, when you want to search by email address only, you’ll have a list of tools you need.