Email & Domain OSINT Toolkit

All-in-one OSINT lookup for emails + domains. Per email: disposable / role detection, mailbox provider, optional password breach check (HIBP k-anonymity). Per domain: WHOIS, full DNS (A/AAAA/MX/TXT/SPF/DMARC/DKIM probe), SSL cert + days-to-expiry, public HIBP breach metadata. All free APIs. $0.005 per target.

---

Why this exists

Security teams + sales prospecting + IT ops all run the same three lookups (WHOIS, DNS, SSL) plus a breach check. Commercial tools (Hunter.io, Whoxy, SecurityTrails) bundle these but cost $50-500/month.

This actor wraps it for $0.005 per target with no monthly fee.

---

What you get

Per email row

{
  "_type": "email",
  "email": "jane@example.com",
  "local_part": "jane",
  "domain": "example.com",
  "is_disposable": false,
  "is_role_account": false,
  "provider": null,
  "sample_password_breach_count": 0,
  "sample_password_safe": true,
  "fetched_at": "2026-06-10T03:30:00+00:00"
}

Per domain row

{
  "_type": "domain",
  "domain": "example.com",
  "dns": {
    "a": ["93.184.216.34"],
    "aaaa": ["2606:2800:220:1:248:1893:25c8:1946"],
    "mx": ["0 ."],
    "spf": ["\"v=spf1 -all\""],
    "dmarc": ["\"v=DMARC1; p=reject;\""],
    "dkim_probe": {"selector1": "v=DKIM1;k=rsa;p=MIIBI..."}
  },
  "whois": {
    "registrar": "ICANN",
    "creation_date": "1995-08-14T...",
    "expiration_date": "2026-08-13T...",
    "name_servers": ["a.iana-servers.net", "b.iana-servers.net"]
  },
  "ssl": {
    "common_name": "*.example.com",
    "organization": "Internet Corporation for Assigned Names and Numbers",
    "issuer_cn": "DigiCert Global G3 TLS ECC SHA384 2020 CA1",
    "not_after": "Mar  1 23:59:59 2026 GMT",
    "days_until_expiry": 263,
    "san": ["example.com", "www.example.com", "*.example.com"]
  },
  "hibp_breaches": []
}

---

Use cases

1. Pre-sales prospect verification — Is this lead's domain real? Active? Reputable?
2. Security triage — Did our org show up in a public breach?
3. SSL expiry watch — Catch certs about to expire across your portfolio
4. Phishing investigation — Quick WHOIS + DNS on a suspicious domain
5. Email validation — Filter disposable / role accounts before sending newsletters
6. Password safety education — Use the k-anon HIBP check to demo why a password is bad

---

Quick start

Single email + auto-domain

{
  "email": "jane@example.com"
}

Batch with explicit domains

{
  "emails": ["jane@apify.com", "bob@anthropic.com"],
  "domains": ["openai.com", "perplexity.ai"]
}

Speed mode (skip WHOIS + SSL)

{
  "domains": ["..."],
  "skipWhois": true,
  "skipSsl": true
}

Password safety check

{
  "email": "you@yourdomain.com",
  "samplePassword": "password123"
}

Privacy: Only the first 5 chars of the SHA-1 hash of your password are sent to HIBP (k-anonymity). The plaintext password and full hash never leave the actor.

---

Pricing

Pay-Per-Event: $0.005 per target (email or domain).

Run	Targets	Cost
Single prospect	1 + 1	$0.01
Outreach list of 100	100 + 30	$0.65
Domain portfolio audit (300 domains)	300	$1.50

Vs SecurityTrails ($199/mo), Whoxy ($150/mo), Hunter.io ($49+/mo).

---

Data sources (all free, no paid keys)

• HIBP Pwned Passwords: api.pwnedpasswords.com (k-anonymity)
• HIBP Breach Metadata: haveibeenpwned.com/api/v3/breaches (public list)
• WHOIS: python-whois library
• DNS: dnspython
• SSL/TLS: Python stdlib

---

Limitations

• WHOIS coverage varies by TLD. Some ccTLDs hide registrant info.
• DKIM probe tries 5 common selectors — if your domain uses a custom selector, the probe miss is normal.
• HIBP per-email check (which uses paid API) is NOT included. We only check passwords (free) and domain-level breach metadata (free).

For per-account breach lookup, add your HIBP API key in a future version.

---

Related actors (same author)

• Crypto Address Sanctions Checker — On-chain equivalent
• Wallet Label Lookup
• HTML Metadata Extractor
• Sitemap URL Discovery

---

Feedback

A short review helps security / sales teams find it: Leave a review on Apify Store