Digital Footprint OSINT: Email to Accounts, Profiles, Domains

Enter email addresses you are authorized to investigate, with optional usernames, domains, or phone numbers. The Actor coordinates public-source checks and returns structured account, profile, and domain-finding rows, a summary for each email address, and a Markdown report. It is built for security teams, brand-protection work, and authorized digital-footprint reviews; source coverage and availability determine what a run can find.

For each email address, the Actor checks account registration signals across 120+ services, derives username candidates for searches across up to 3,000 sites, and profiles company domains for registration facts and look-alikes. A profile found for a derived username is a public lead, not proof that it belongs to the same person. Free-plan runs deliver up to 25 result rows across the submitted inputs, then finish normally with a notice. Paid plans receive the full result set, subject to the input and run limits below.

What one address turns into

Step	What happens	What you get
The address	Checked against 120+ services for a registered account	One row per service the address is registered on
The name in front of the @	Turned into username candidates: plain, without dots and underscores, without trailing digits	The candidates that were searched
Each candidate	Searched across up to 3000 sites, most popular first	One row per public profile, with its URL
The domain after the @	Registration facts plus registered look-alike domains	Registrar, age, expiry, and every look-alike that can receive mail
Each address	A free summary row	Headline, exposure score 0–100, and its LOW / MEDIUM / HIGH band

Role mailboxes (info@, support@, hr@ and the like) are never turned into usernames — they belong to a company, not a person. Free mail domains (gmail.com, outlook.com, naver.com and the like) are not profiled, because the domain belongs to the provider.

A Markdown report also lands in the run's key-value store under the key REPORT.

Input

Field	Description
emails	The addresses to investigate. Name <name@example.com> and mailto: forms are accepted
usernames	Extra usernames to search alongside the derived ones (optional)
domains	Extra domains to profile. A domain named here is also checked for subdomains and published addresses (optional)
phones	Phone numbers in E.164 form, used only with includePhone (optional)
deriveUsernames	Turn addresses into username candidates. Default true
maxUsernamesPerEmail	Candidates per address, 1–3. Default 2
maxSitesPerUsername	Sites searched per username, 50–3000. Default 250
maxEmails	Addresses processed per run, 1–25. Default 3
includeDomainInsights	Profile company domains. Default true
includePhone	Opt in to phone lookups (sensitive). Default false
disclaimerAck	Required. Confirms authorized, lawful use

The previous single-target input still works: an address, username, domain or phone number sent as target is routed to the right field.

Example

{
  "emails": ["octocat@github.com", "Jane Doe <jane.doe@acme.com>"],
  "deriveUsernames": true,
  "maxSitesPerUsername": 250,
  "disclaimerAck": true
}

Input that cannot be investigated ends the run as SUCCEEDED with a notice row, not a failure.

Output

Every result row carries rowType, kind, target, label, value, url, confidence, detail and source. Summary rows add score. Rows with rowType: "notice" are messages, not results.

kind	What it is
account	A service the address is registered on
profile	A public profile found for a username
registration	Registration facts for a domain
lookalike	A registered look-alike of the domain
subdomain, email	Found for a domain you named directly
phone	Phone intelligence (opt-in)
summary	Per-address headline and exposure score — never charged

Pricing (pay-per-event)

What you pay today: $0.02 per discovery, plus $0.20 once per run for the report. A $0.01 run-start fee is added from 10 September 2026.

A price change is coming. The flat $0.20 report fee will be removed, so that you pay for what the run finds rather than for the report:

Event	Price
Run started	$0.01
Account found (per registered service)	$0.02
Profile found (per public profile)	$0.02
Domain finding (registration, look-alike, subdomain, address)	$0.02

The exact date will be announced here and on the Actor's pricing page at least 14 days before it takes effect, as Apify requires. Until then the current list stands. The actor reads the live price list and bills under whichever list is in force — you never pay both.

Notice rows are never charged. On a free Apify plan a run delivers up to 25 result rows as a preview; a paid plan receives the full footprint.

The specialist actors run under your own account and bill you separately. This actor starts them, so those runs appear in your run list and on your invoice alongside this one. Their current rates:

Source	Charges	Rate
Email OSINT Search	per account found	$0.02
Maigret	per profile found	$0.02
WHOIS Domain Lookup	per domain looked up	$0.02
dnstwist	per registered look-alike found	$0.03
theHarvester	per domain harvested	$0.05
PhoneInfoga	per number scanned	$0.05

Worked example

One corporate address that turns up 9 registered accounts, 2 username candidates with 34 profiles between them, and a domain with 3 look-alikes, priced under the coming list:

run start                     $0.01
9 accounts   × $0.02          $0.18
34 profiles  × $0.02          $0.68
4 domain findings × $0.02     $0.08
                       this actor: $0.95
child actors: 9 × $0.02 + 34 × $0.02 + $0.02 + 3 × $0.03   = $0.99
                              total: ~$1.94

A quiet address costs far less. Findings vary by target, so this is a worked example, not a quoted price. Use the run's Max charge limit to put a hard ceiling on any single run, and lower maxSitesPerUsername to search fewer sites.

Prefer to run the tools yourself?

Every source above is a standalone actor you can run directly. Doing that skips this actor's fee; you then work out the username candidates, run each tool, and join the results yourself. Use this actor when one address in and a finished footprint out is worth more to you than that work.

Legal / ethical use

Unofficial and not affiliated with any of the services checked. This actor queries only publicly available sources and confirms account existence rather than collecting personal profile fields. It is intended for authorized security research, penetration testing, brand protection, and personal digital-footprint audits.

By setting disclaimerAck: true you confirm you are authorized to investigate these targets and will comply with all applicable laws, including the GDPR, Korea's PIPA, the CFAA and local privacy law. You are the data controller for anything you collect with it. Do not use it for harassment, stalking, doxxing, or any unlawful purpose.