Email OSINT Search — 120+ Sites Account Discovery

Find which accounts an email address has signed up for. This email lookup / email OSINT tool discovers which 120+ sites an email is registered on — LinkedIn, Twitter, Spotify, Pinterest, Imgur, Tumblr, and many more — without ever sending a password-reset notification to the target. A fast reverse email search powered by holehe (GPL-3.0, 5.6k+ stars), the standard open-source email OSINT tool — ideal for fraud checks, KYC, and finding out where an email is used.

Built for security researchers, fraud investigators, OSINT analysts, KYC teams, and recruiters who need to verify online presence of a given email address with zero footprint.

Legal Disclaimer: This Actor is an unofficial integration of holehe (megadose) and is not affiliated with or endorsed by the original project. Use only on email addresses you own or have explicit authorization to investigate. Comply with PIPA (KR), GDPR (EU), CCPA (US), and applicable privacy laws.

Why this Actor

• 120+ sites checked in one call (LinkedIn, Twitter/X, Spotify, Pinterest, Imgur, Tumblr, Adobe, Atlassian, etc.)
• No password-reset emails sent to target — uses passive account-existence signals
• Flat, table-ready output — one row per account found, with platform, domain and detection method
• Bulk mode — process up to 500 emails per run (hard cap)
• Pay only per account found — $0.02 per confirmed account
• No subscription, no setup, no scraping — just an API call

Use Cases

• Security incident response — given a breached email, map exposure across SaaS
• Fraud investigation — confirm an email is a real online identity, not a throwaway
• Recruiter verification — confirm candidate email is registered on professional platforms
• KYC enhancement — supplement identity verification with online-account footprint
• OSINT pentesting — reconnaissance phase for authorized engagements
• Data-broker compliance — auditing your own organization's email exposure

Input

Field	Type	Required	Description
emails	array of string	✅	Up to 500 email addresses to investigate
email	string	—	Legacy single-email input (use emails for batch)
timeout	integer	—	Per-site timeout in seconds (default 30)
maxEmails	integer	—	How many emails this run processes; hard cap 500

{
  "emails": ["alice@example.com", "bob@example.org"],
  "timeout": 30,
  "maxEmails": 10
}

Output

One dataset item per registered account found — not one per email. An address registered on 17 sites produces 17 rows, so the output is ready to filter, sort and export as a flat table.

Field	Type	Description
email	string	The address checked
platform	string	Platform short name, e.g. codepen
domain	string	Platform domain, e.g. codepen.io
exists	boolean	true when an account was detected on that platform
method	string	How existence was detected: register, login or other
rateLimit	boolean	true when holehe flags this site as one that throttles frequent lookups (a static property of the site, not a failure of this lookup) — the account is still confirmed, so the row is charged; the flag simply tells you the site is worth re-verifying
charged	boolean	true when this row was billed as an account-found event
emailRecovery	string	Masked recovery-email hint, when the platform exposes one (else null)
phoneNumber	string	Masked partial phone, when the platform exposes one (else null)
sitesChecked	integer	Total platforms probed for this email
disclaimer	string	Legal-use notice, repeated on every row

A confirmed, billable account:

{
  "email": "test@gmail.com",
  "platform": "codepen",
  "exists": true,
  "domain": "codepen.io",
  "method": "register",
  "emailRecovery": null,
  "phoneNumber": null,
  "rateLimit": false,
  "charged": true,
  "sitesChecked": 121
}

A confirmed account on a site holehe flags as frequently rate-limiting — still billed, with rateLimit: true telling you the site is worth re-verifying:

{
  "email": "test@gmail.com",
  "platform": "anydo",
  "exists": true,
  "domain": "any.do",
  "method": "login",
  "emailRecovery": null,
  "phoneNumber": null,
  "rateLimit": true,
  "charged": true,
  "sitesChecked": 121
}

When an address is registered nowhere, you get a single summary row instead (platform: null, exists: false, foundCount: 0, plus a note), so a succeeded-but-empty run is never confused with a failure. A per-email failure returns one row carrying an error field.

You can download the dataset as JSON, HTML, CSV or Excel.

Pricing

$0.02 per registered account found (event: account-found). Every confirmed account is charged, including those on sites flagged rateLimit: true (that flag is a property of the site, not a failed lookup). Sites where the email is not registered are free, sites where verification could not be completed (download error, unreadable response, engine error) are free, and an address registered nowhere costs nothing.

What a run actually costs. A live test of test@gmail.com returned 17 confirmed accounts, all 17 billable — $0.34 (two of them were on sites flagged as frequently rate-limiting, but the accounts were confirmed and therefore charged). A typical personal address lands in the $0.20–$0.60 range, so a 25-address batch usually costs $5–$15. Set the run's maximum cost in Run options before a large batch.

Every row tells you whether it was billed: charged: true means the account counted toward your bill, charged: false means it did not. Apify platform compute is included — there is no separate compute charge.

Large batches and the run charge limit

Every Apify run has a maximum cost, which you set per run (or per schedule) in the Actor's Run options. This Actor accepts up to 500 email addresses in a single run, and a big batch can easily find more accounts than the default limit covers.

When a run reaches its charge limit, this Actor stops checking and finishes successfully with everything it found up to that point, plus a final Charging limit reached record explaining what happened. You are never charged past your limit, and the run is not reported as a failure.

To get the full batch, do one of the following:

• Raise the run's maximum cost in Run options before starting, or
• Split the email addresses across several runs — for example 25 emails per run instead of 500.

Quick Start

curl

curl -X POST "https://api.apify.com/v2/acts/ntriqpro~email-osint-search/runs?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"emails": ["alice@example.com"]}'

Python (Apify Client)

from apify_client import ApifyClient
client = ApifyClient("YOUR_TOKEN")
run = client.actor("ntriqpro/email-osint-search").call(run_input={
    "emails": ["alice@example.com", "bob@example.org"]
})
items = list(client.dataset(run["defaultDatasetId"]).iterate_items())
for item in items:
    if not item.get("exists"):
        continue
    flag = " (site frequently rate-limits — re-verify)" if item.get("rateLimit") else ""
    print(f"{item['email']} -> {item['platform']} ({item['domain']}){flag}")

Limitations

Limitation	Detail
Sites that frequently rate-limit	holehe flags ~10-15% of sites as ones that throttle frequent lookups. Confirmed accounts on those sites are flagged rateLimit: true so you can re-verify — they are charged, since the account was confirmed. Only lookups that could not be completed at all are free
False positives	Existence signals can be ambiguous; treat as leads, not proof
New site discovery	holehe upstream adds sites quarterly; we update with library releases
Rate limiting	Recommended: batch <10 emails per run to avoid IP-based throttling

Technology

• holehe (GPL-3.0) — Email-based account existence checker, 5.6k+ stars
• Apify SDK for Python (Apache 2.0) — Actor runtime
• httpx (BSD) — Async HTTP client

Disclaimer

This Actor is an unofficial open-source wrapper around megadose/holehe. It is not affiliated with, sponsored by, or endorsed by the holehe project, its maintainers, or any of the platforms being probed. OSINT results are based on publicly observable account-existence signals and may produce false positives.

You are solely responsible for ensuring you have legal authorization to investigate any email address. Misuse may violate privacy laws (PIPA, GDPR, CCPA, etc.) and the terms of service of target platforms. This tool is intended for security research, fraud prevention, and authorized investigation use only.

Privacy & data responsibility

You are the data controller for every search you run with this Actor; ntriqpro is a data processor acting solely on your instructions. You are responsible for having a lawful basis and a legitimate, purpose-limited reason for each lookup, and for complying with GDPR, PIPA, CCPA, and other applicable privacy laws. We do not store your results — output is written only to your own run's dataset and is never retained on our side. Use this Actor only for lawful purposes and only on email addresses you own or are authorized to investigate.

---

🔗 Related Actors by ntriqpro

Running several of these by hand? OSINT Recon Suite takes one target — email, username, domain or phone — runs Maigret, Sherlock, holehe, theHarvester, WHOIS and dnstwist against it, then correlates everything into a single risk-scored report. One input, one report, instead of six separate runs to stitch together yourself.

Build your full OSINT stack:

• maigret-actor — Username OSINT across 3000+ sites (5.0★ rated)
• phoneinfoga-osint — Phone number OSINT — carrier, country & footprint
• dnstwist-osint — Typosquatting & phishing domain detector
• subfinder-osint — Subdomain finder for attack-surface mapping
• gitleaks-secret-scanner — Find leaked secrets in public repos

⭐ Rate this Actor

If this saves you investigation time, please leave a review — it helps other security researchers discover it.