Email OSINT Pro – Account Finder

Enter an email address and discover public account-existence signals across supported platforms, with broader coverage and clearer evidence than a basic email OSINT scan.

Email OSINT Pro separates what was FOUND, what returned NOT_FOUND, and what remained uncertain because of rate limits, timeouts, or errors. Each email becomes one clean Dataset result with found accounts, scan-quality metrics, and issues you can review.

The goal is not just to check more platforms — it is to return more usable answers and reduce uncertainty caused by blocked, timed-out, or inconclusive checks.

In a direct Apify Cloud network benchmark, Email OSINT Pro loaded 176 email checkers and achieved a 74.72% average conclusive rate, compared with about 121 checks and 38% conclusiveness for the Holehe baseline. Benchmark outcomes vary by email, platform behavior, and network conditions; these are observed results, not a detection guarantee.

Use this Email OSINT tool for authorized security research, account exposure assessment, due diligence, fraud and risk research, brand protection, trust and safety investigations, and API-based investigation workflows.

Why Email OSINT Pro

• Find more potential account signals. Broader platform coverage creates more opportunities to surface useful account-existence signals that narrower scans may miss.
• More usable answers, not just more checks. conclusiveRate shows how much of the scan actually reached a usable FOUND or NOT_FOUND outcome.
• Do not mistake a failed check for NOT_FOUND. Rate limits, timeouts, errors, and inconclusive responses remain visible as uncertainty instead of being silently reported as a negative result.
• One email = one decision-ready result. Review found accounts, scan quality, issues, and timing in one Dataset item rather than reconstructing an answer from hundreds of platform rows.
• Safer recovery-flow handling. Potentially notifying recovery checks are off by default, helping reduce the risk of triggering account-recovery notifications during routine scans.

Quick Start

For most users, start with Balanced and leave potentially notifying checks disabled.

1. Add one or more email addresses.
2. Choose Balanced for normal investigations or Fast for initial triage.
3. Leave potentially notifying checks off unless you specifically need them and have authorization.
4. Click Start.
5. Open Dataset → Overview to review account signals and scan quality.

{
  "emails": ["test@example.com"],
  "scanMode": "balanced",
  "includePotentiallyNotifyingSites": false
}

test@example.com is a reserved documentation example. Results for it are not intended to be meaningful. The Actor trims, lowercases, validates, and deduplicates supplied addresses before scanning.

What Makes a Useful Email OSINT Scan?

The number of platforms checked is only part of the story. A useful scan answers three questions:

• How broadly did it search? → platformsAvailable
• How many checks produced a real answer? → conclusiveRate
• What account signals were found? → accounts

Email OSINT Pro exposes all three, so you can judge the result instead of relying on one ambiguous “found/not found” number.

Email OSINT Pro vs. Holehe

The direct Apify Cloud benchmark below used the same two test emails for both products. It compares observed scan quality, not a promise that any future email will produce the same result.

What matters to you	Holehe baseline	Email OSINT Pro
Conclusive answers	~38% average	74.72% average
Uncertain checks	~62% average	25.28% average
Platform coverage	~121 checks	176 available modules
Result per email	Raw platform-level output requires extra reconstruction	One clean Dataset result per email
Can I tell why a check failed?	Requires reviewing individual platform output	Yes — rate limits, timeouts, and errors are separated
Can I judge scan quality quickly?	Limited	Yes — conclusiveRate and uncertainty counts
Potentially notifying recovery checks	Not exposed as a simple safety choice	Off by default; explicit opt-in
Ready for API / Dataset workflows	Requires additional normalization	Structured Apify Dataset output

Broader coverage and a higher conclusive rate give Email OSINT Pro more opportunities to surface useful account signals than a narrower or highly uncertain scan. A matched, auditable benchmark total for FOUND signals from Holehe was not retained, so this table intentionally does not claim a numeric “more accounts found” result.

Benchmark notes

• Network: direct Apify Cloud / datacenter network; no proxy was used for the compared scans.
• Emails: two identical test emails per compared run.
• Pro metric: 263 conclusive checks out of 352 available checks, for a 74.72% average conclusive rate in the original comparison benchmark.
• Platform policies, anti-bot controls, and network conditions change. Re-run the same test set if you need a current comparison for your own use case.

Choose a Scan Mode

Mode	Choose this when	Trade-off
Balanced — recommended	You want stronger scan completeness for investigations	Gives slower platforms more time to respond.
Fast	You want quicker initial triage or are processing larger batches	More slow platforms can end as TIMEOUT or INCONCLUSIVE.

Balanced gives slower checkers more time; Fast uses a shorter per-check budget for quicker triage. The preset details are intentionally managed by the Actor so users can choose a mode without tuning internal parameters.

Input

Field	Type	Required	Default	Limits	Description
emails	array of strings	Yes	Form prefill supplied in the Actor	1–100 items	Email addresses to check. Inputs are trimmed, lowercased, validated, and deduplicated; one unique input email produces one result.
scanMode	enum	No	balanced	balanced or fast	Selects the user-facing speed/completeness preset.
includePotentiallyNotifyingSites	boolean	No	false	—	Enables checks identified upstream as potentially capable of sending a recovery or similar notification. Leave off for safer routine research.

Invalid email syntax is returned as one Dataset item with scanStatus: "INVALID_INPUT"; no platform checks run for that item.

Understand Your Result

Each email produces exactly one Dataset item. The Overview view places these fields first:

Field	Meaning
accounts	Account-existence signals surfaced by the scan, including platform, category, and URL when available.
conclusiveRate	FOUND + NOT_FOUND, divided by checks actually attempted. Higher means less uncertainty in that scan.
platformsAttempted	Checkers that actually ran.
uncertainCount	Attempted checks that were rate limited, timed out, errored, or remained inconclusive.
elapsedMs	End-to-end wall-clock scan time for that email.

platformsAvailable = platformsAttempted + platformsSkipped. Checks skipped because the safety setting excludes potentially notifying flows do not lower conclusiveRate.

Short Output Example

This is an illustrative structure, not output from test@example.com.

{
  "email": "person@example.com",
  "scanStatus": "COMPLETED",
  "scanMode": "balanced",
  "platformsAvailable": 176,
  "platformsAttempted": 149,
  "platformsSkipped": 27,
  "foundCount": 2,
  "notFoundCount": 130,
  "uncertainCount": 17,
  "conclusiveRate": 0.8859,
  "accounts": [
    {
      "platform": "Example Service",
      "category": "Social",
      "url": "https://example.com",
      "extra": {}
    }
  ],
  "issues": {
    "rateLimited": ["Example Limited Service"],
    "timeout": ["Example Slow Service"],
    "errors": []
  },
  "elapsedMs": 9800
}

Complete Output Field Reference

Field	Description
email	Normalized input email address.
scanStatus	COMPLETED or INVALID_INPUT.
scanMode	Selected balanced or fast preset.
potentiallyNotifyingSitesIncluded	Whether potentially notifying checks were enabled.
validationError	Present only for invalid input syntax.
platformsAvailable	All currently loaded email checkers.
platformsAttempted	Checkers actually run. Equals foundCount + notFoundCount + uncertainCount.
platformsSkipped	Checkers intentionally not run because the selected safety setting excluded potentially notifying flows.
foundCount / notFoundCount	Count of FOUND account signals / confirmed NOT_FOUND results.
conclusiveCount	foundCount + notFoundCount.
conclusiveRate	conclusiveCount / platformsAttempted.
uncertainCount	Sum of rate-limited, timeout, error, and inconclusive attempted checks. It excludes SKIPPED.
rateLimitedCount / timeoutCount / errorCount / inconclusiveCount	Breakdown of uncertainty.
accounts	FOUND-only objects described below.
issues	Compact diagnostic lists described below.
elapsedMs	End-to-end wall-clock duration for one email scan.
checkedAt	UTC timestamp at which the result item was produced.

accounts[]

Only FOUND signals are included, so users get useful evidence without a noisy list of all platform checks.

Field	Description
platform	Service returning the account-existence signal.
category	Upstream service category when available.
url	Relevant public service URL when supplied by the checker.
extra	Additional non-secret upstream evidence when available. Its shape varies by platform.

issues

issues keeps scan-quality transparency without returning a full 176-platform debug trace.

Field	Description
rateLimited	Platform names with explicit rate-limit or IP-block evidence.
timeout	Platform names that exceeded the active time budget.
errors	Platform names with other non-conclusive errors.

INCONCLUSIVE outcomes remain included in uncertainCount and inconclusiveCount; they do not have a separate verbose platform list in the formal Dataset.

API Usage

Use the Actor identifier lance_api/email-osint-pro-account-finder. Replace APIFY_TOKEN with an API token stored in your own environment.

JavaScript

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('lance_api/email-osint-pro-account-finder').call({
  emails: ['person@example.com'],
  scanMode: 'balanced',
  includePotentiallyNotifyingSites: false,
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Python

import os
from apify_client import ApifyClient

client = ApifyClient(os.environ['APIFY_TOKEN'])
run = client.actor('lance_api/email-osint-pro-account-finder').call(run_input={
    'emails': ['person@example.com'],
    'scanMode': 'balanced',
    'includePotentiallyNotifyingSites': False,
})

items = client.dataset(run['defaultDatasetId']).list_items().items
print(items)

cURL

curl -X POST 'https://api.apify.com/v2/acts/lance_api~email-osint-pro-account-finder/runs?token=APIFY_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "emails": ["person@example.com"],
    "scanMode": "balanced",
    "includePotentiallyNotifyingSites": false
  }'

Use the returned run's defaultDatasetId to retrieve result items through the Apify API.

Pricing

Simple per-email pricing: $0.010 per completed valid email scan at the standard rate, with eligible Apify discount tiers reducing the price to $0.007 per scan.

One email = one email-scan billing event, regardless of how many account signals are found. Finding more account signals does not increase the price for that email. An invalid email is not charged because no completed scan result is produced.

Apify discount tier	Per completed email	Per 1,000 completed emails
FREE	$0.010	$10
BRONZE	$0.009	$9
SILVER	$0.008	$8
GOLD	$0.007	$7

Use Cases

• Email OSINT investigations: Quickly assess publicly observable account-registration signals connected to an email.
• Account exposure assessment: Understand where an address may have an account footprint and which checks remain uncertain.
• Fraud and risk research: Add structured account-existence evidence to an authorized review workflow.
• Brand protection and trust & safety: Investigate potential impersonation or account exposure signals while keeping uncertainty visible.
• Due diligence: Use account signals as one input to a broader, authorized assessment.
• API and AI investigation workflows: Send normalized per-email results directly into downstream datasets, rules, or agents.

How It Works

For each valid email, the Actor loads supported public account-registration checkers, applies the selected preset, and aggregates the results into one normalized Dataset item. It keeps confirmed account signals separate from confirmed non-results and uncertainty. Potentially notifying flows are excluded unless you opt in.

FAQ

What can Email OSINT Pro find from an email?

It can surface public account-existence signals from supported platform registration or recovery flows. A FOUND signal is evidence reported by a platform check, not proof of identity or ownership.

Can it find social media accounts by email?

It checks supported social and other service categories for public account-existence signals. Coverage changes as upstream platforms change their flows.

Why can Pro produce more useful results than a narrower email OSINT scan?

It combines broader platform coverage with a higher observed conclusive rate in our benchmark, while keeping blocked, timed-out, and failed checks separate from confirmed negatives.

What does conclusiveRate mean?

It is (FOUND + NOT_FOUND) / platformsAttempted. It tells you how much of the attempted scan produced a usable answer.

Does NOT_FOUND always mean no account exists?

No. It means the relevant checker returned a non-existence signal at that time. Platforms can change behavior, block datacenter traffic, or alter their flows.

What does uncertain mean?

It covers rate limits, timeouts, errors, and inconclusive responses. These are kept separate so they are not confused with NOT_FOUND.

Can a scan trigger password-recovery notifications?

Potentially notifying checks are disabled by default. Enabling them can broaden coverage but may increase notification risk; use them only with authorization. No setting can guarantee that a third-party platform will never send a notification.

What is the difference between Fast and Balanced?

Balanced gives slow services more time and is recommended for normal investigations. Fast shortens waits for quicker triage, accepting that more slow checks may be uncertain.

How many platforms does it check?

The current bundled scanner loads 176 email checkers. A run may attempt fewer when potentially notifying checks are disabled or when the checker catalog changes.

How am I charged? Does finding multiple accounts cost more?

One completed valid email scan creates one email-scan event. Finding one account or multiple account signals does not add extra events for that email.

Does it verify email deliverability, access private accounts, or retrieve passwords?

No. It is not a mailbox-verification, credential-access, or private-account-access tool.

Limitations

• Platform flows, anti-bot controls, availability, and rate limits can change at any time.
• A FOUND result is an account-existence signal, not proof of identity, ownership, or access.
• A NOT_FOUND result is not an absolute guarantee that no account exists.
• The Actor does not intentionally use proxies by default; direct network conditions affect results.
• Results are for authorized research only and should be assessed alongside other lawful evidence.

Responsible Use

Only scan email addresses when you have a legitimate purpose and appropriate authorization. Respect applicable law, privacy expectations, and each platform's terms of service. Do not use this Actor to harass, profile, or target individuals.

Open-Source Attribution and License

This Actor is built on and includes adapted execution of user-scanner, version 1.5.1, commit 14184c2691e3ee567061f577883ad4a6ff3e8a04, under the MIT License. On top of that upstream foundation, Email OSINT Pro adds Apify-ready input and Dataset normalization, safety-aware recovery-flow handling, result-quality metrics, performance measurement and tuning, practical speed presets, compact diagnostics, and per-email billing behavior.

Support

Contact lanceapi2026@hotmail.com or open an issue through the Actor's project page. For faster help, include the Run ID, a non-sensitive sample email, scan mode, conclusiveRate, and relevant issue names.

Never send an Apify token, password, cookie, API key, session data, or other private credentials.