Holehe

OSINT Email Lookup

An OSINT email lookup turns a single email address into actionable intelligence about the person behind it: platforms, exposures, identity hints and pivot points, all drawn from public sources. This page walks through the techniques and shows you a free, browser-based tool to run one in seconds.

What "OSINT email lookup" really means

OSINT, Open-Source INTelligence, is the discipline of finding answers using only data that is already public. Applied to email, it means:

  • No phishing, no password guessing, no buying stolen databases
  • Only public sign-up responses, public profiles, public breach indexes
  • Repeatable, defensible findings that can be cited in a report

The five layers of an email OSINT investigation

  1. Format and provider, is the address valid? Is it Gmail, Outlook, Proton, a corporate domain, a disposable address? The provider already tells you a lot.
  2. Account footprint, which platforms is the address registered on? This is where Holehe shines: 200+ sites scanned in seconds.
  3. Breach exposure, has the address appeared in known data leaks? HaveIBeenPwned, DeHashed, IntelX.
  4. Identity resolution, who is behind the account? Google profile, avatars, public names, photos.
  5. Network pivots, once you have a username or a domain, expand outward to related handles and infrastructure.

Free OSINT email lookup with Holehe

Holehe covers layer 2, the account footprint, better than any free tool we know. Paste an email, and it queries the public sign-up or password-recovery flow of 200+ sites to tell you, for each one, whether an account exists.

  • No login, no scraping, no password attacks
  • Categorised report: social, developer, shopping, gaming, music…
  • Runs from the browser, including mobile
  • Reusable, shareable report URL

Run an OSINT email lookup now →

Typical OSINT email lookup workflow

  1. Validate the email syntax and resolve the MX record of the domain.
  2. Run Holehe to fingerprint the platforms the address is registered on (free, in browser).
  3. Cross-check with HaveIBeenPwned and EmailRep for breach + reputation data.
  4. If Gmail, run GHunt for the public Google profile.
  5. Pivot on the strongest usernames using Sherlock or Maigret.
  6. Document the chain of evidence with source URLs and timestamps.

Who uses email OSINT?

  • Pentesters and red-teamers, external recon, social-engineering scoping.
  • Threat intelligence analysts, profiling malicious senders and compromised mailboxes.
  • Journalists and OSINT researchers, verifying sources, mapping public figures' online presence.
  • Fraud, trust and safety, triaging sign-ups, refund abuse, fake accounts.
  • Law enforcement and legal teams, within their authorised remit.

Ethics and legality

OSINT email lookup is powerful and easy to misuse. The fact that data is public does not mean every investigation is lawful. Stick to authorized engagements, respect local data protection law (GDPR, CCPA, etc.), and remember that "need" is not the same as "right." Holehe is built for legitimate work, please use it that way.

Frequently asked questions, OSINT email lookup

What is an OSINT email lookup?
An OSINT email lookup turns a single email address into intelligence using only public sources, registered platforms, breach indexes, public profiles. No password attacks, no scraping of private data.
Is OSINT email research legal?
Reading public sign-up signals and breach indexes is generally lawful, but legality depends on your jurisdiction and the purpose of the investigation. Use OSINT email tools for authorised pentesting, threat intelligence, journalism, fraud triage, or your own accounts.
What is the best free OSINT email tool?
Holehe is the canonical free tool for mapping an email’s account footprint across 200+ sites. Pair it with HaveIBeenPwned for breach exposure, GHunt for Gmail-specific data, and Sherlock or Maigret for username pivots.
Can OSINT find a person from an email address?
Yes, often. The Holehe report reveals which platforms the address is registered on; each platform’s public profile often exposes a display name, avatar and bio. Image reverse search and username pivots can take you further.
How accurate is OSINT email lookup?
Account footprint signals (Holehe, EmailRep) are highly accurate when sites respond cleanly. Identity resolution from a single email is probabilistic, treat results as leads and verify before acting.