Digital Footprint OSINT: Email to Accounts, Profiles, Domains

Enter email addresses you are authorized to investigate, with optional usernames, domains, or phone numbers. The Actor coordinates public-source checks and returns structured account, profile, and domain-finding rows, a summary for each email address, and a Markdown report. It is built for security teams, brand-protection work, and authorized digital-footprint reviews; source coverage and availability determine what a run can find.

For each email address, the Actor checks account registration signals across 120+ services, derives username candidates for searches across up to 3,000 sites, and profiles company domains for registration facts and look-alikes. A profile found for a derived username is a public lead, not proof that it belongs to the same person. Free-plan runs deliver a 25-row preview — one row of each kind of finding first, plus one address summary — then finish normally with a notice that counts the rows left locked and gives an estimated list-price total for them. Paid plans receive the full result set, subject to the input and run limits below.

	Free plan	Paid plan
Result rows per run	25, including one per-address summary; one of each kind of finding (account, profile, registration, look-alike, …) first	Every row found, up to 600 per run
Per-address exposure summaries	1 of N shown, the rest counted	One per address
Markdown REPORT	Built from the preview	Built from everything found
Locked part	The closing free-plan-preview notice counts the locked rows by kind and the locked summaries, with an estimated list-price total	Nothing locked

What one address turns into

Step	What happens	What you get
The address	Checked against 120+ services for a registered account	One row per service the address is registered on
The name in front of the @	Turned into username candidates: plain, without dots and underscores, without trailing digits	The candidates that were searched
Each candidate	Searched across up to 3000 sites, most popular first	One row per public profile, with its URL
The domain after the @	Registration facts plus registered look-alike domains	Registrar, age, expiry, and every look-alike that can receive mail
Each address	A free summary row	Headline, exposure score 0–100, and its LOW / MEDIUM / HIGH band

Role mailboxes (info@, support@, hr@ and the like) are never turned into usernames — they belong to a company, not a person. Free mail domains (gmail.com, outlook.com, naver.com and the like) are not profiled, because the domain belongs to the provider.

A Markdown report also lands in the run's key-value store under the key REPORT.

Input

Field	Description
emails	The addresses to investigate. Name <name@example.com> and mailto: forms are accepted
usernames	Extra usernames to search alongside the derived ones (optional)
domains	Extra domains to profile. A domain named here is also checked for subdomains and published addresses (optional)
phones	Phone numbers in E.164 form, used only with includePhone (optional)
deriveUsernames	Turn addresses into username candidates. Default true
maxUsernamesPerEmail	Candidates per address, 1–3. Default 2
maxSitesPerUsername	Sites searched per username, 50–3000. Default 250
maxEmails	Addresses processed per run, 1–25. Default 3
includeDomainInsights	Profile company domains. Default true
includePhone	Opt in to phone lookups (sensitive). Default false
disclaimerAck	Required. Confirms authorized, lawful use

The previous single-target input still works: an address, username, domain or phone number sent as target is routed to the right field.

Example

{
  "emails": ["octocat@github.com", "Jane Doe <jane.doe@acme.com>"],
  "deriveUsernames": true,
  "maxSitesPerUsername": 250,
  "disclaimerAck": true
}

Input that cannot be investigated ends the run as SUCCEEDED with a notice row, not a failure.

Output

Every result row carries rowType, kind, target, label, value, url, confidence, detail and source. Summary rows add score. Rows with rowType: "notice" are messages, not results.

kind	What it is
account	A service the address is registered on
profile	A public profile found for a username
registration	Registration facts for a domain
lookalike	A registered look-alike of the domain
subdomain, email	Found for a domain you named directly
phone	Phone intelligence (opt-in)
summary	Per-address headline and exposure score — never charged

Pricing (pay-per-event)

What you pay: $0.01 per run, $0.02 per discovery, and $0.20 once per run for the report.

The $0.20 report fee covers the Markdown REPORT and the per-address exposure summary rows. It is charged once, after they are delivered, and only when the run's charging limit still covers it. If the limit is used up by the result rows, the report and summaries are not generated: every result row already delivered stays (each was charged), a report-withheld notice explains why, and the run still finishes SUCCEEDED. Result rows stop at the limit the same way — a row the limit no longer covers is not delivered.

Event	Price
Run started	$0.01
Each result row (account, profile, or domain finding)	$0.02
Report and exposure summaries	$0.20 once per run

Any future change to this list will be announced here and on the Actor's pricing page at least 14 days before it takes effect, as Apify requires. The actor reads the live price list and bills under whichever list is in force.

Notice rows are never charged. On a free Apify plan a run delivers a 25-row preview (one row of each kind of finding first, and one address summary), and the closing free-plan-preview notice says how many more rows and summaries a paid plan would return and roughly what they cost at list price (an estimate, not a quote); a paid plan receives the full footprint.

If Apify migrates or restarts a run partway, the restarted run checks its own dataset and the platform's charge count first: a row already delivered is not written or charged again, the run-start fee and the report fee are asked for at most once, and a row that was charged but not yet written is written without a second charge. Two notice rows, run-start-fee (written when the run starts, before anything is charged) and report-fee (written right before the report fee), let a restart tell where the run stopped; they are not results and are never charged. Whether the run-start fee was already paid is read from the platform's charge count, not from the dataset. A restarted run queries the specialist actors again, and those runs bill as usual.

The specialist actors run under your own account and bill you separately. This actor starts them, so those runs appear in your run list and on your invoice alongside this one. Each specialist run also has its own run-start fee ($0.005–$0.01). Their rates, as listed on each Actor's pricing page (free-plan list price; paid Apify plans pay less):

Source	Charges	Rate
Email OSINT Search	per account found	$0.02
	per email searched with no account found	$0.01
Maigret	per profile found	$0.02
	per username searched (from 27 October 2026)	$0.05
WHOIS Domain Lookup	per domain looked up	$0.02
	per domain with no registry record (from 27 October 2026)	$0.02
dnstwist	per registered look-alike found	$0.03
	per domain scanned (from 27 October 2026)	$0.05
theHarvester	per host, IP or email found	$0.005
	per domain checked (from 27 October 2026)	$0.05
PhoneInfoga	per number scanned	$0.05
	per scanner result row (from 31 October 2026)	$0.01

Worked example

One corporate address that turns up 9 registered accounts, 2 username candidates with 34 profiles between them, and a domain with 3 look-alikes, at the rates in force from 27 October 2026:

run start                          $0.01
47 result rows (9 + 34 + 4) × $0.02  $0.94
report                             $0.20
                       this actor: $1.15
child actors:
  9 accounts × $0.02                         $0.18
  2 usernames × $0.05 + 34 profiles × $0.02  $0.78
  1 domain looked up                         $0.02
  1 domain scanned $0.05 + 3 × $0.03         $0.14
                       child actors: $1.12 (+ their run-start fees)
                              total: ~$2.27

A quiet address costs far less. Findings vary by target, so this is a worked example, not a quoted price. Use the run's Max charge limit to put a hard ceiling on any single run, and lower maxSitesPerUsername to search fewer sites.

Prefer to run the tools yourself?

Every source above is a standalone actor you can run directly. Doing that skips this actor's fee; you then work out the username candidates, run each tool, and join the results yourself. Use this actor when one address in and a finished footprint out is worth more to you than that work.

Legal / ethical use

Unofficial and not affiliated with any of the services checked. This actor queries only publicly available sources and confirms account existence rather than collecting personal profile fields. It is intended for authorized security research, penetration testing, brand protection, and personal digital-footprint audits.

By setting disclaimerAck: true you confirm you are authorized to investigate these targets and will comply with all applicable laws, including the GDPR, Korea's PIPA, the CFAA and local privacy law. You are the data controller for anything you collect with it. Do not use it for harassment, stalking, doxxing, or any unlawful purpose.

Leave a review

A short review on the Reviews tab, good or bad, helps other people find this Actor and tells us what to build next. Found a bug or need a feature? Open an issue on the Issues tab and we'll look into it.