Disclaimer: This article is for education and for lawful, authorised professional research. Use these methods only where you have a legitimate purpose and a lawful basis, and follow the laws and platform terms that apply to you, including data protection law such as the UK GDPR and EU GDPR. See our Terms of Service.
TL;DR
- We show why structured email research beats quick one-off checks for verification and risk triage.
- You'll learn the manual workflow (search operators, hash checks, header reading, registration records) and where it breaks.
- We pivot to UserSearch Email Intelligence to run several third-party data sources, enrichment and AI summaries from one account, with a record of what you did.
- Two worked scenarios: (1) a newsroom checking whether a press office address is genuine; (2) a fraud analyst scoring the history of an onboarding address.
- Finish with legal and ethical guardrails and a clear next step with UserSearch.
If a username is the public name an account goes by, the email address is its registration anchor. It is the "primary key" of the internet: required to open accounts with banks, suppliers, software platforms, marketplaces and forums alike. Most organisations and staff hold dozens of addresses, each leaving a trail of registrations across the web.
For analysts, an email address is rarely a dead end. It is a hub. A single address can connect to dozens of platforms, historical records, registered domains and related addresses. Email Intelligence in OSINT is the process of taking that single string of text, [email protected], and turning it into a clear, sourced picture of how and where the address has been used, and whether that fits the organisation that claims it.
The Synthetic Applicant Problem
Fraud teams increasingly see "synthetic" applicant records built from a mix of real and invented data. A credit application might use a real name and a valid document number, but a "fresh" email address created just for the application. Standard credit checks often miss this.
Email research is one of the best counters to synthetic applications. A genuine long-standing address has depth accumulated over years: a Spotify account from 2018, a Pinterest account from 2015, and a record in historical data sets from 2019. A synthetic application often comes with an address created last week with no history at all. If you see an applicant with an excellent credit file but an email address with no presence on any professional or consumer service, that is a signal worth a second look.
In this guide, we go beyond basic checks. We explain how email presence checks work, teach you the manual methods analysts use (including header reading and hash checks), and show you how to use UserSearch to bring the results together into structured, sourced findings.
1. What Is Email Intelligence in OSINT?
Email Intelligence means querying public sources, platform registration signals, historical data sets and technical records to see where an email address has been used. Unlike a standard web search, which only finds text published on pages, these checks often rely on how services respond to an address.
The Mechanics of "Presence"
How can a data source know an address is registered on a site? Most methods rely on registration signals or deduction:
- Registration responses: When an address already in use is entered at sign-up, some services respond with "This email is already registered." Data providers record these public responses at scale, which is how presence checks work.
- Public account images: Some services, such as Gravatar, publish an account image at a predictable address derived from the email, as we show in the manual method below.
- Historical data sets: Third-party collections show whether, and from when, an address appeared in records from particular online services.
Repeated across hundreds of services, these checks move you from "this address exists" to "this address is used for software development, online retail and a trade forum", which you can then compare with the story you have been told.
2. Why It Matters: Business Email Fraud
Email research is often the deciding step in high-stakes checks, because it is the bridge between an online persona and a real-world organisation.
Case Study: Payment Diversion
Consider business email fraud. Operators register lookalike domains or use free email providers to pose as executives or suppliers and request urgent bank transfers. The FBI's Internet Crime Complaint Center publishes regular warnings about business email fraud, and the UK's National Cyber Security Centre explains how to spot and report suspicious emails.
In these cases, the email itself is usually the strongest lead. An address that claims to belong to a supplier's finance team but has no link to the supplier's domain, no business presence and a registration history on unrelated consumer sites does not fit the story. Checking that before a payment goes out is far easier than recovering funds afterwards.
Key Professional Use Cases
- Verifying sources and documents: Newsrooms check whether an address that sends documents is long-established and linked to the organisation it names, or was opened the same day.
- Fraud prevention and KYC: Banks and retailers check the depth of an address during onboarding. A genuine long-standing address usually has registrations on mainstream services. A throwaway address usually has none.
- Cyber threat intelligence (CTI): Analysts connect an address found in phishing infrastructure or domain registrations to other domains and accounts registered with the same address, to map a campaign.
3. The Manual Method: The "Hard Way"
Before you automate your workflow, it helps to understand the manual methods. They help you verify results and understand what automated tools are doing.
Method A: The Gravatar Hash Check
Gravatar (Globally Recognized Avatar) is used by millions of sites, including WordPress. Users upload an image once, and it appears across every site that uses Gravatar. The Gravatar developer documentation explains the public API.
Gravatar image URLs use a hash of the email address, so you can check an address manually:
- Take the email address, convert it to lower case and trim whitespace.
- Calculate the MD5 hash of the string (Gravatar also accepts SHA-256).
- Append it to the URL:
https://gravatar.com/avatar/HASH?d=404
If an image loads, the address has a public Gravatar account. If you get a 404, there is no public image. The d=404 parameter tells Gravatar to return an error instead of a default image, which makes the result clear.
# Python snippet to generate the hash
import hashlib
email = "[email protected]".strip().lower().encode('utf-8')
print(hashlib.md5(email).hexdigest())Why MD5? MD5 is an older hashing algorithm (defined in RFC 1321) that is no longer considered safe for cryptographic security but is still used as an email identifier by services like Gravatar. Because it is a consistent one-way function, [email protected] always produces the same string, which allows cross-site correlation without publishing the plain-text address.
Method B: Registration Records and Domains
Organisations often use one administrative address to register several domains. Historical WHOIS records, where available, can show which domains an address has registered over time, and when.
whois example.com | grep -i -E "registrant|admin|creation|updated"The whois command queries the registry for the domain, and grep -i -E filters the output (case-insensitive, extended regular expression) to the registrant, administrative contact and date lines. Many registrations now show a privacy service instead of a real contact, so historical records, taken before privacy was switched on, are often more useful than the current one. For more on this, see our guide to domain OSINT and WHOIS infrastructure.
Method C: Reading Email Headers
If your organisation has received a message from the address, the headers show the route the message took and the systems that handled it. This is useful for establishing which mail service or organisation sent it.
- Open the email and view "Original Source" or "Show Headers".
- Find the last
Received:header that is not your own mail server. - Check the
Authentication-Resultsline for SPF, DKIM and DMARC results. - Run the sending server's IP or hostname through an IP or domain lookup to see which provider or organisation operates it.
A message that claims to come from a supplier but fails DMARC for the supplier's domain, or was sent through an unrelated bulk mail service, is a strong reason to verify through a known contact.
The Limit of Manual Checks
Manual OSINT works, but it is slow and fragmented. You need one tool for hashing, another for WHOIS history, another for presence checks and another for historical data sets. It is a tedious workflow that does not scale.
4. The Pivot: Enter UserSearch
UserSearch brings these scattered methods into a single research platform. Instead of running five different scripts and managing Python dependencies, you run an Email Intelligence search that draws on several third-party data sources through one UserSearch account.
Layer 1: The Presence Map
The free fast email check and the Email (OneScan) Module query a wide range of services to see where the address is registered. OneScan runs one input across the data sources you select and merges the results with source attribution. This is not just a "Yes/No" list; it shows how the address is used.
Scenario: Your firm receives an introduction from a supposed "senior investment broker" at [email protected].
The Search: You run the address in UserSearch.
The Result: No professional presence at all: no LinkedIn, no Xing, no business directory. Instead, the address is registered on Roblox, Steam and a niche anime forum.
The Conclusion: The address does not fit the claimed role. A senior broker with no professional presence but an active gaming account is a mismatch, so your firm declines to proceed until the broker's authorisation is confirmed on the regulator's register.
Layer 2: History in Third-Party Data Sets
Finding an address in historical data sets might sound like old news, but for an analyst it is useful. It helps confirm the address's age and validity.
Scenario: An address appears in historical records from a professional networking service dated 2016 and a marketing database dated 2019.
The Insight: The address has been in use for at least nine years. It is an established address, not one created yesterday for a single application. This history adds weight to the legitimacy of the account, although it does not by itself tell you who is using it today.
Layer 3: Provider Analytics (Proton)
Privacy-focused providers like Proton Mail share very little. However, they still publish some metadata. The ProtonMail Analyse Module in UserSearch can show the creation date of the address's public encryption key.
Scenario: Your company receives an email from [email protected] claiming it has held copies of your company files "for months" and demanding a response.
The Insight: The Module shows the key was created yesterday. That does not settle the matter, but it undermines the "for months" claim and gives your incident team a dated fact to work with while they review logs.
Technical Note: This works because Proton publishes PGP public keys on its key server to allow automatic encryption between users. You can see the same key yourself:
curl "https://api.protonmail.ch/pks/lookup?op=get&[email protected]"The op=get parameter asks for the key itself and search= takes the address. The key contains a creation timestamp, which usually matches when the address was set up.
5. Advanced Strategies: Pivoting with Care
OSINT becomes most useful when you combine email results with other data points. Here are three strategies that stay focused on organisations, domains and accounts.
Strategy 1: The Domain Ownership Pivot
Businesses and sole traders often use the same address to register several websites.
The Workflow:
1. Run the address through the Website Domain Ownership (by Email) Module in UserSearch.
2. Discover that it registered example-trading.com in 2018.
3. Visit example-trading.com (if it is offline, check the Wayback Machine).
4. The site may show a trading name, a company number or a registered office, which you can then confirm on the official company register. That lets you establish which organisation stands behind the address.
Strategy 2: The Organisation Directory Check
If the address uses a corporate domain, check whether the domain and the organisation line up. A quick review of the domain's mail records shows which provider handles its email:
dig MX example.com +short
dig TXT example.com +shortdig MX lists the mail servers for the domain and dig TXT returns its text records, which usually include SPF and verification entries for services like Microsoft 365 or Google Workspace. The +short flag trims the output to the answers only.
Insight: A domain that claims to belong to an established firm but has no mail records, or was registered last month, is a mismatch. A domain whose records point to the same provider and tenant as the firm's main domain is a good sign. Either way, record what you found and when.
Strategy 3: The GitHub Commit Email
Developers often configure their local git clients with a work or personal address, and that address is recorded in the commit metadata of public repositories. GitHub explains this, and its no-reply alternative, in its documentation on setting your commit email address.
The Technique:
1. Search GitHub commits for the address using the qualifier author-email:[email protected].
2. Review the public repositories it has contributed to. For a software supplier under review, this shows whether the claimed engineering work actually exists and which projects the firm maintains.
3. Keep your review to the organisation's public code and projects; the purpose is to verify the supplier's claims, not to build a picture of an individual developer.
6. Legal and Ethical Guardrails
Email research sits close to the line between research and intrusion. Keep to these principles:
- Stay passive: Use sources that return information about an address rather than sending anything to it. Contacting the address, or sending messages with content that reports back when they are opened, needs specific authorisation, and in some settings could prejudice a matter being handled by law enforcement.
- Read, do not sign in: UserSearch returns information from third-party data sources on demand; it does not contact the address or sign in to any account. Keep your own work the same.
- Respect data privacy: Under the UK GDPR and EU GDPR, an email address can be personal data. Make sure you have a lawful basis (security, fraud prevention, legitimate interest or journalism) and keep your scope proportionate.
For more on this, read the ICO guidance on legitimate interests to understand how to frame your research lawfully.
The Inbox Is Just the Beginning
An email address is more than a communication channel; it is an anchor for an organisation's online accounts. By moving from a single address to a sourced map of registrations, history, domains and technical records, you can judge whether an address really belongs to the organisation that claims it.
Whether you are checking a new supplier, confirming a sales lead or reviewing a suspicious message, the method is the same: Validate. Enumerate. Corroborate.
Don't let a generic webmail address be the end of your research. Look at its full history.
Stop guessing. Start researching with UserSearch. Run your first Email Intelligence search on UserSearch, compare several sources in one OneScan, and keep your findings in a Case ready for your report.