Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Username/Email

Usernames and Email Addresses

Corporate usernames have become increasingly predictable, following standardized naming conventions such as FIRSTNAME.LASTNAME@CORP.com. This consistency extends to account management systems, which often derive usernames from the email prefix. Security professionals can leverage these patterns to identify:

  • Accounts on other services using the same username

  • Credentials exposed in data breaches

  • Associated websites, social media profiles, and online tools

  • Linked accounts across multiple platforms

Username and email enumeration is a fundamental OSINT technique that can reveal substantial intelligence about individuals and organizations.

Username and Email Address Analysis Tools

Username.html and Email.html

These complementary tools often produce overlapping results, but it's best practice to search both the username and email address separately to capture any discrepancies. These tools perform two primary functions:

  1. Presence Detection: Verify if the username or email exists on various platforms

  2. Exposure Analysis: Identify any publicly available or leaked information associated with the credentials

Local helper copy: Username.html

Local helper copy: Email.html

Username Search Tools

  • WhatsMyName - Enumerate usernames across multiple websites and platforms

  • UserSearch.org - Dedicated search engine for username discovery

  • NameChk - Check username availability across multiple platforms simultaneously

  • Namecheckr - Check username and domain availability across social media and web

  • Sherlock - Hunt down social media accounts by username across 400+ social networks

  • Maigret - Collect information about username across 2500+ sites, improved fork of Sherlock

  • socialscan - Python library and CLI for accurately querying username and email usage on online platforms

  • Blackbird - Search for usernames across 600+ social networks and websites

  • AnalyzeID - Check username availability across social media platforms and gather basic profile information

  • IDCrawl - Free people search engine aggregating social network information, deep web data, phone numbers, and email addresses

  • Instant Username Search - Check username availability across multiple social media platforms instantly

  • KnowEm - Check username or real name availability across 500+ popular and emerging social media platforms

Email Address Search Tools

  • MXToolBox - Comprehensive suite of tools for gathering data about email addresses and domains

  • Seon Email Analysis - Enrich user profiles and gather intelligence based on a single email address

  • Epieos Tools - Suite of tools for email address investigation including account discovery and Google ID lookup

    • Holehe GitHub - CLI tool for checking email registration across 120+ platforms

  • EmailRep.io - Query email reputation and registration data across multiple platforms

  • OSINT Industries - Email and username lookup across breaches and online accounts

Breach Data and Credential Exposure

Identify whether usernames or email addresses have been exposed in data breaches:

  • Have I Been Pwned - Check if an email address has been compromised in a data breach. Includes API access for automated queries (API key required).

  • DeHashed - Search engine for leaked credentials and breach data across thousands of databases (paid subscription required for full access)

  • LeakCheck - Database of leaked credentials with detailed breach information and search capabilities (paid plans for detailed results)

  • IntelligenceX - Search engine for leaked databases, documents, and credentials (free tier available with limitations)

  • Snusbase - Comprehensive breach data search engine with advanced filtering options (paid subscription required)

  • LeakIX - Search engine for open databases and data leaks

  • Dehashed API Tool - Python CLI tool to query DeHashed API (requires DeHashed subscription)

  • BreachDirectory API - Free API access to breach data for checking email compromise

Email Address Enumeration Tools

Use these tools when you have identified a target but need to discover their email address:

  • Hunter.io - Discover email addresses by company name or domain (free tier has limited searches)

  • Voila Norbert - Email discovery service using company name or individual details (now VoilaNorbert by Kaspr, requires account)

  • Clearbit Connect - Powerful email discovery tool (Chrome extension required, limited free searches)

  • Email Format - Identify email address format patterns used by specific companies or domains

  • Snov.io Email Finder - Locate employee email addresses using domain names (requires account for full functionality)

  • RocketReach - Professional email finder with extensive database (limited free searches)

  • Apollo.io - Sales intelligence platform with email discovery features

Email Verification Tools

Verify whether an email address is valid and actively registered before conducting further investigation:

  • Email Hippo - Connects to mail servers to verify whether an email address and mailbox actually exist

  • Verify Email - Validates email addresses by connecting directly to mail servers and checking mailbox existence

  • Email Checker - Real-time email validation that confirms address correctness and active status without sending messages

  • NeverBounce - Enterprise-grade email verification service with real-time validation

  • ZeroBounce - Email validation and deliverability service with detailed verification

CLI Email Intelligence Tools

  • TheHarvester - Industry-standard tool for email intelligence gathering that aggregates information from numerous sources. Supports API integration with services like Censys and Shodan (API keys required). Highly effective when combined with web-based tools listed above.

  • Infoga - Gathers comprehensive email account information (IP address, hostname, country) from multiple public sources including search engines, PGP key servers, and Shodan. Includes breach detection via haveibeenpwned.com API. Note: Repository not actively maintained but tool remains functional.

  • email2phonenumber - OSINT tool for obtaining a target's phone number from their email address through Google services correlation. Note: Effectiveness has decreased due to Google privacy changes.

  • GHunt - Google account information scraper that extracts publicly available data from Google accounts (actively maintained)

  • h8mail - Email OSINT and password breach hunting tool supporting both local and premium service searches. Features related email tracking and correlation. (Note: Some data sources may require updates)

  • EmailFinder - Discovers email addresses associated with a domain using search engine queries

  • Crosslinked - LinkedIn enumeration tool to extract valid employee names from an organization for email permutation

Broad recon frameworks such as SpiderFoot, Recon-ng, Maltego, and Sn1per are maintained with recon frameworks. Use this page for username and email-specific pivots.

Recon Frameworks
Profile Picture and Avatar Analysis

Profile pictures can be used to correlate accounts across platforms:

  • Gravatar Search - Search for profile pictures associated with email addresses via Gravatar service

  • PimEyes - Reverse image search specifically for faces (paid subscription required for full results)

  • TinEye - Reverse image search to track where profile pictures appear online

  • Google Images - Reverse image search functionality for finding profile picture matches

  • Social Searcher - Free social media search engine to find profile pictures and posts

Email Permutation and Enumeration Techniques

Common Email Format Patterns

When enumerating corporate email addresses, test these common patterns:

  • firstname.lastname@company.com (most common)

  • firstnamelastname@company.com

  • firstname_lastname@company.com

  • f.lastname@company.com

  • flastname@company.com

  • firstname.l@company.com

  • firstname@company.com

  • lastname.firstname@company.com

  • firstinitiallastname@company.com

Email Verification via SMTP Commands

SMTP servers can be queried to verify email existence (note: many modern servers disable these for security):

  • VRFY - Verify if an email address exists

  • EXPN - Expand mailing list membership

  • RCPT TO - Check if server accepts mail for an address

Google Dorking for Email Discovery

Advanced Google search operators for finding email addresses:

Username Correlation Techniques

  1. Pattern Analysis: Identify naming patterns from known accounts

  2. Cross-Platform Validation: Verify same username exists on multiple platforms

  3. Temporal Analysis: Check account creation dates for correlation

  4. Behavior Correlation: Match posting times, language patterns, and interests

  5. Bio/Description Matching: Compare profile descriptions for similar content

Deprecated or Unreliable Tools

Tools No Longer Recommended

These tools were previously included but are now deprecated, shut down, or have become unreliable. They are kept here for historical reference.

Email Enumeration:

  • Phonebook.cz - Service has been shut down and is no longer accessible. Consider using IntelligenceX or Hunter.io as alternatives.

  • EmailCrawlr - Service appears to be offline or unreliable. Use Hunter.io or Apollo.io instead.

  • Public Mail Records - Service reliability has declined significantly.

  • Skymem - Mailing list archive search service that is outdated and no longer maintained reliably.

Email Verification:

  • TruMail - API service is no longer reliably accessible. Use Email Hippo or NeverBounce as alternatives.

Username Search:

  • Lullar Search - Service functionality has declined and results are often limited.

  • Stalker - GitLab repository appears inactive; tool may not be maintained.

  • finduser - Repository archived and no longer maintained. Use Sherlock, Maigret, or Blackbird instead.

Note: When a tool becomes unavailable, consider using comprehensive frameworks like SpiderFoot or Recon-ng which aggregate multiple data sources and are regularly maintained.

Investigation Mind Maps

PreviousDomainNextName, Phone, Gov Record

Last updated