Email Finder & Reverse Phone Lookup — Contact Enrichment

Paste emails, phone numbers, company domains or usernames. Get back everything public about each one, source by source. One identifier turns into many rows: the public accounts tied to it, the phone's carrier and line type, the company domain's registration, DNS and homepage, the emails the company publishes on its own site, breach history and a one-row person summary with a 0–100 confidence score that shows which signals produced it.

This Actor is an independent, unofficial tool. It is not affiliated with, endorsed by, or sponsored by Gravatar, GitHub, GitLab, Hacker News, dev.to, Keybase, Docker Hub, npm, Chess.com, Lichess, Reddit, XposedOrNot, Have I Been Pwned, rdap.org or any other source it reads. It uses only public, logged-out endpoints: no login, no captcha solving, no password-reset probing, no account pools. You are responsible for having a lawful basis to look up the identifiers you enter, for complying with each source's terms of service and with privacy law (GDPR, CCPA, PIPA and others) in your jurisdiction, and you are the data controller for any personal data a run you start returns. Use the output for lawful purposes only (sales research, fraud and KYC checks, security reviews, verifying your own data). Every result row carries this notice in its responsibility field.

Who this is for

Sales and lead-generation teams enriching a CRM list, recruiters checking a candidate's public footprint, fraud and trust-and-safety analysts screening sign-ups, and security teams auditing their own company's exposure.

What one run returns

rowType	One row per	Key fields
identifier-check	identifier	identifierType (email, phone, domain, username, invalid), verdict, mxFound, mxHosts, disposable, roleBased, freeProvider, e164
account	public account found	site, username, profileUrl, matchedBy (email-hash, public-email, username), profile (only with includeProfileFields)
phone-profile	phone number	e164, valid, countryCode, carrier, lineType (mobile, fixed-line, voip, toll-free…), region, timeZones, international, national
domain-profile	company domain × source	source = rdap (registrar, registeredAt, expiresAt, nameservers, registrantOrganization), dns (dnsRecords, mailProvider, hasSpf, hasDmarc) or website (pageTitle, metaDescription, siteName, techHints, socialLinks)
company-email	email published on the company's own pages	email, foundOn, roleBased
breach	public breach record	breachScope (email or domain), breachName, breachDate, dataClasses, pwnCount
person-summary	identifier	displayName, companyName, companyDomain, location, phoneCountry, phoneCarrier, accountsFound, accountSites, socialProfiles, breachCount, confidence, confidenceSignals, sourcesChecked, sourcesUnanswered
notice	message	noticeCode, message — never charged

Every row also has identifier, identifierType, normalized, source, checkedAt and responsibility. Company-domain layers run for company emails and domains only; free-mail domains (gmail.com, outlook.com…) are skipped.

Sources. Accounts: Gravatar (email hash), GitHub public-email search, and username checks on GitHub, GitLab, Hacker News, dev.to, Keybase, Docker Hub, npm, Chess.com, Lichess and Reddit (the email's local part is used as the username unless it is a role address such as info@). Phone: libphonenumber data, offline. Domain: rdap.org, DNS, the company's homepage and its contact, about and team pages. Breaches: XposedOrNot for emails, the Have I Been Pwned public breach catalogue for domains. Breach rows name the breach and the data classes; they never contain passwords, hashes or dump contents.

Pricing (pay per event)

Event	Charged per	USD (FREE plan)	Bronze	Silver	Gold+
run-started	run	0.005	0.004	0.00325	0.0026
identifier-checked	unique identifier checked	0.005	0.004	0.00325	0.0026
account-found	account row	0.02	0.016	0.013	0.0104
phone-profiled	phone profile row	0.03	0.024	0.0195	0.0156
domain-profiled	domain source row (max 3 per domain)	0.02	0.016	0.013	0.0104
company-emails-found	company email row	0.02	0.016	0.013	0.0104
breach-signal	breach row	0.03	0.024	0.0195	0.0156
person-summary	summary row	0.05	0.04	0.0325	0.026

What is charged and what is not.

• A row written to the dataset is charged once under its event. The same account, domain source, company email or breach is never charged twice in one run, even when two identifiers lead to it (two emails on one company domain pay for the domain once).
• identifier-checked is charged for every unique identifier we check, including one the check finds malformed (for example jane@@acme): the check is the work. Empty lines and repeats are dropped before the check and cost nothing.
• Sites where no account exists, and sites that did not answer (rate limit, block), produce no account row and no charge; they are listed in the summary's sourcesUnanswered.
• Notice rows (noticeCode: invalid input, time limit, spending limit) are messages, never charged.
• When your maximum charge per run is reached the run stops paid work and ends with a notice row.

Example: one company email with every layer on, 3 public accounts, 3 domain rows, 4 company emails and 1 breach: start $0.005 + check $0.005 + accounts $0.06 + domain $0.06 + company emails $0.08 + breach $0.03 + summary $0.05 = about $0.29. A phone number alone: $0.005 + $0.005 + $0.03 + $0.05 = $0.09. Switch layers off to pay only for what you need.

Input

{
  "identifiers": ["jane.doe@acme.com", "+14155552671", "acme.com", "janedoe"],
  "layers": ["accounts", "phone", "domain", "companyEmails", "breaches", "summary"],
  "includeProfileFields": false,
  "defaultCountry": "US",
  "timeoutPerIdentifier": 60
}

• identifiers — array, up to 500 per run. The type of each value is detected automatically.
• layers — leave empty for all. The identifier check always runs.
• includeProfileFields — off by default: account rows confirm the account exists. Turn it on to also copy public display name, company, location and bio, and to use them in the summary. Turn it on only when you have a lawful basis to process that personal data.
• defaultCountry — country for numbers written without +.
• timeoutPerIdentifier — seconds before lookups for one identifier stop (10–300).

Output example

{ "rowType": "identifier-check", "identifier": "jane.doe@acme.com", "identifierType": "email", "verdict": "deliverable", "mxFound": true, "freeProvider": false }
{ "rowType": "account", "identifier": "jane.doe@acme.com", "site": "github", "username": "jane.doe", "profileUrl": "https://github.com/jane.doe", "matchedBy": "username" }
{ "rowType": "domain-profile", "identifier": "jane.doe@acme.com", "domain": "acme.com", "source": "dns", "mailProvider": "google-workspace", "hasDmarc": true }
{ "rowType": "company-email", "identifier": "jane.doe@acme.com", "email": "sales@acme.com", "foundOn": "https://acme.com/contact", "roleBased": true }
{ "rowType": "person-summary", "identifier": "jane.doe@acme.com", "companyName": "Acme", "accountsFound": 3, "confidence": 70, "confidenceSignals": ["identifier-valid", "mail-server-found", "account-found", "company-domain", "company-website-live"] }

Limits worth knowing

• Unauthenticated public APIs have rate limits (GitHub allows about 60 lookups an hour from one IP). A source that stops answering is reported in sourcesUnanswered, never guessed.
• The phone carrier is the carrier the number range was originally allocated to; a number moved to another carrier keeps its original name.
• A username match on a site means an account with that name exists there, not that it belongs to the same person. The summary's confidence counts the signals; judge the match yourself.

Runs on the Apify platform

Schedule it, call it from the API, or plug it into a workflow. It needs no browser and no proxy; 1 GB of memory is enough.