Email/Username OSINT

Corporate usernames can be obnoxiously easy to guess and build. The standard of is so common, it's ridiculous. Even more so when account management tools will simply take the first half of the email and reuse it as a username. We can use schemes like this to our advantage to search for a multitude of treasures like accounts on other services with the same username, credentials found in breaches, and associated sites or tools. When searching for usernames, you can uncover linked social media accounts and tons of relevant intelligence.

Email Search Tools

  • MXToolBox - Collection of online tools that can gather multiple points of data surrounding an email address or domain

  • - Enrich user data based on a single email address

  • Epieos - Enter an email address and see which sites the email address has been used.

  • HoleHE - CLI Tool to check if an email is attached to an account on sites like twitter, instagram, imgur and more than 120 others

Email Discovery Tools

  • - Discover email addresses by company name

  • - Phonebook lists all domains, email addresses, or URLs for the given input domain.

  • Voilanorbert - Discover email addresses by company name

  • Connect.Clearbit - Email discovery tool, only works in chrome.

  • Email Format - Find the email address format for a given company or domain.

  • - Locate employee email addresses via domain name.

  • TheHarvester - This tool is the defacto standard for email intelligence gathering. It checks a large array of sources to pull together information. It can leverage APIs of other services such as Spyse or Shodan to improve the search. Remember these will require an API key to use. I have found that between the above html tools and this, it will satisfy your email searching needs.



Breached password list from Magnet link

theHarvester -d domain -b search


h8mail -t

Username Search Tools

  • WhatsMyName - This tool allows you to enumerate usernames across many different websites.

  • UserSearch - Search Engine for Usernames

  • Name Check - See if a username is available across multiple platforms

  • Sherlock - Hunt down social media accounts by username across social networks

  • SocialCcan - Python library and CLI for accurately querying username and email usage on online platforms

  • AnalyzeID - Social media username checker. Gather information on the taken username and get a summary of who the person is

  • IDCrawl - A free people search engine that organizes social network information, deep web information, phone numbers, email addresses and more


sherlock user

Last updated