Email Lookup
Discover where an email address has publicly detectable accounts, registered service footprints, and known security breach exposures.
How This Scan Works
Format Validation
Validates email RFC syntax, extracts the domain, and verifies public mail exchange (MX) DNS records.
Public Endpoint Probing
Queries non-invasive public endpoints and account existence signals across supported services.
Footprint Synthesis
Aggregates confirmed service registrations, public avatar profiles, and breach exposure records.
What Can Be Found
- •Public service registrations and active accounts tied to the email
- •Public avatar profiles, usernames, and display names via Gravatar
- •Domain MX and mail server infrastructure details
- •Known data breach exposure and disclosure records
What Cannot Be Determined
- •Email passwords, credentials, or inbox contents
- •Private correspondence, draft emails, or personal contacts
- •Real-time IP address or physical location of the email owner
- •Accounts on services that employ blind registration responses
Sample Platform Signals
Gravatar
Public hash lookups reveal user avatars, associated handles, and bio text.
GitHub / Developer Hubs
Public author commits and verified email associations in git logs.
Public Breach Repositories
Checks against known historical security compromises.
Limitations & Corroboration Notice
- •Modern platforms increasingly use anti-enumeration protections, making some account detections inconclusive.
- •An email appearing in a breach dump does not mean the current password has been compromised if it was changed.
- •Queries are executed strictly in memory to maintain confidential auditing standards.
Frequently Asked Questions
Can anyone see what email I am looking up?▼
No. OSINTScan processes all email searches ephemerally in memory without logging or saving any queries to disk.
Does looking up an email send an alert or message to that address?▼
No. Our checks evaluate passive public metadata and non-invasive existence endpoints. We never send emails to the target address.
What should I do if my email appears in a public breach?▼
Immediately change your password on that service and any other account where you reused that password, and enable app-based two-factor authentication (2FA).