what-an-email-reveals

Name: what-an-email-reveals
Availability: InStock
Author: UseOSINT

Investigate email addresses through MX validation, Gravatar lookup, breach checks, and header analysis.

38|2|Updated Aug 2, 2026

Search Tags:#osint #gravatar #dkim #header analysis #phishing triage #email investigation #breach lookup

Ready to run

npx skills add https://github.com/UseOSINT/Skills --skill what-an-email-reveals-useosint

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: what-an-email-reveals
Source: https://github.com/UseOSINT/Skills/tree/main/skills/what-an-email-reveals
Command: npx skills add https://github.com/UseOSINT/Skills --skill what-an-email-reveals-useosint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? An email address is often the highest-value selector in an OSINT investigation, but proving it exists is hard and the techniques that do so expose the investigator. This Skill provides a disciplined, passive-first workflow for extracting intelligence from an email address without tipping off the subject. ## Core Features & Use Cases - Validation and Parsing: Distinguishes syntactic, MX/domain, and SMTP-level validation, handles Gmail dot and plus-tag normalization, and infers corporate email formats from known addresses. - Footprint Discovery: Checks Gravatar by MD5 hash, searches breaches and indexed documents for account registrations, and pivots the local part into username investigations. - Header Forensics: Reads the Received chain bottom-up, interprets SPF, DKIM, and DMARC verdicts, and fingerprints sending platforms via Message-ID and X-Mailer fields. - Use Case: During phishing triage, trace a suspicious invoice email back through its headers to identify the actual sending infrastructure, then check whether the claimed sender address appears in breach corpora. ## Quick Start Investigate the email address [email protected] and report its validity, breach exposure, and likely owner with confidence grades.

Frequently Asked Questions about what-an-email-reveals

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate an email address for OSINT?▼

Start with passive steps: validate syntax and MX records, check Gravatar by MD5 hash of the lowercased address, search breach corpora, and query the address in quotes on search engines. Avoid SMTP RCPT TO probes, which are interactive, logged, and defeated by catch-all domains.

How to verify if an email address actually exists?▼

True existence verification requires an SMTP RCPT TO probe, which is interactive, often blocked, and meaningless against catch-all domains that accept every recipient. Passive alternatives like breach appearances and Gravatar profiles provide stronger practical evidence of a real, used mailbox.

How do I trace where an email came from using headers?▼

Read the Received chain bottom-up, since the bottom-most entry is the earliest hop and everything below your trust boundary can be forged. Check Authentication-Results for DKIM, SPF, and DMARC verdicts; a DKIM pass is the strongest evidence because it cryptographically signs the content.

Can I infer a company's email address format from employee names?▼

Yes, collect two or three real addresses from press releases, conference PDFs, or commit metadata and derive the pattern, such as first.last or flast. Treat every inferred address as a hypothesis until it appears independently in a breach, document, or Gravatar profile.

Why does email validation fail on catch-all domains?▼

A catch-all domain accepts mail for every recipient, so any SMTP probe returns success regardless of whether the mailbox exists. Detect one by testing an obviously invented address; if it validates, all verification results from that domain are meaningless.

What are the legal risks of email enumeration techniques?▼

SMTP probing and password-reset enumeration are interactive, commonly violate terms of service, and may constitute unauthorized system interrogation in some jurisdictions. Under GDPR an email address is personal data, so collect only what the objective requires and get interactive techniques authorized in writing.