Email OSINT Lookup - Find Accounts, Breaches & Identity

Email OSINT Lookup

Email OSINT lookup for investigators, fraud teams and security researchers. Give it an email address; it finds the accounts registered to it on 133 platforms, who the address belongs to, and which data breaches it has been exposed in.

Only definitive account findings become dataset rows. Checks that cannot complete are reported as unknown, never as "no account". Checks that require sending login or recovery email, or creating an account, are also left unresolved. A source that does not answer must not become a confident negative.

What this email OSINT lookup returns

Identity enrichment

Not just a yes/no. Where the data exists, you get a name and real profile URLs.

Source	Returns
Gravatar	Real name, location, job title, and verified LinkedIn / X / GitHub / Instagram profile URLs
GitHub	GitHub username and profile resolved from commit authorship

Account detection

Group	Platforms
Learning & education (19)	Alison, Allen, Asafeer, Aslbloom, Babbel, Bnrlanguages, Bunpo, Cakeapp, Cambly, Classdojo, Coursera, Duolingo, Hanzii, Hellochinese, Heyjapan, Programminghub, Quizlet, Talkpal, Vedantu
Developer & tech (18)	Codecademy, Codewars, Devrant, Envato, Hackerearth, Hackerone, Hackerrank, Hackthebox, Howtogeek, Huggingface, Luarocks, Medium, Qiita, Rubygems, Wix, Wondershare, Wordpress, Xda
Social (14)	Classmates, Couplejoy, Facebook, Instagram, Locket, Lovenudge, Mastodon, Meeff, Mewe, Pinterest, Plurk, Slowly, Whering, X
Entertainment (11)	Anilist, Appletv, Dreame, Girlslife, Hoichoi, Justwatch, Myanimelist, Nebula Tv, Stremio, Sunnxt, Weverse
Shopping & commerce (11)	Amazon, Etsy, Fixderma, Flipkart, Hautesauce, Naturabuy, Nykaaman, Rappi, Tatacliq, Vivino, Walmart
Productivity & other (10)	Anydo, Dragongroot, Dropbox, Eventbrite, Firefox, Moz, Numsify, Office365, Screener, Secondline
Creator & design (8)	Adobe, Buymeacoffee, Canva, Figma, Flickr, Kick, Patreon, Vimeo
News & media (7)	Aljazeera, Bbc, Cnn, Flipboard, Foxnews, Globaltimes, Indiatimes
Sports (7)	Aiscore, Besoccer, Espn, Marca, Nba, Playtomic, Uniscore
Fitness (5)	Evolveyou, Finch, Fitnessblender, Myfitnesspal, Sweat
Music (5)	Deezer, Gaana, Jiosaavn, Mixcloud, Spotify
Gaming (4)	Addictinggames, Chess Com, Crazygames, Stackb
CRM (3)	Axonaut, Insightly, Zoho
Dating (3)	Lespark, Okcupid, Skout
Travel (3)	Komoot, Polarsteps, Skyscanner
Community (2)	Disqus, Nextdoor
Hosting (2)	Neocities and one CDN hosting provider
Jobs (1)	Freelancer

Email analysis

Format validation, disposable detection, free-provider detection, business-domain detection, role-account detection (info@, admin@), and name hints.

Security intelligence

Breach history and an A–F risk score based on exposure and account activity.

Input

Field	Type	Required	Default	Description
emails	string[]	Yes	None	Addresses to investigate, one per line
max_results_per_email	integer	No	25	Cap on sources reported per address. You are billed per found source, so this is your cost ceiling per address. 0 disables it
follow_handles	boolean	No	false	Follow at most 3 distinct verified handles per address; paid plans only. Adds checker-run charges described below
max_concurrency	integer	No	10	Emails processed at once (1–10)

A run processes at most five addresses; anything beyond the first five is not looked up. Split larger lists across runs. A minimal input:

{
  "emails": ["beau@dentedreality.com.au"],
  "max_results_per_email": 25
}

Output

The dataset holds one row per channel where the address was found. A row says one thing, so it reads as a table and exports straight to CSV:

email	channel	found	username	profile_url
beau@dentedreality.com.au	amazon	true	null	null
beau@dentedreality.com.au	anydo	true	null	null
beau@dentedreality.com.au	gravatar	true	Beau Lebens	https://gravatar.com/beau

username and profile_url are filled for the channels that expose them and null elsewhere, so the columns stay stable. These example rows were retrieved from the address shown; results can change as source availability changes.

Per-address context is identical on every row, so it is not repeated there. Two records accompany the run instead:

• FULL_RESULTS — one complete record per address: email analysis, every breach with its exposed-data categories, the full channel map, and every unresolved check.
• NO_RESULTS — addresses where nothing was found, and separately any address whose lookup failed. A failed lookup is not the same as finding nothing: nothing is known about it. Neither produces rows and neither is billed.

For the same example address, the summary in FULL_RESULTS read:

{
  "summary": {
    "accounts_found": 11,
    "accounts_checked": 101,
    "accounts_unresolved": 38,
    "is_active_email": true,
    "risk_score": "B"
  },
  "breach_info": {
    "breached": true,
    "breach_count": 31,
    "risk_label": "High",
    "risk_score": 73
  }
}

Each breach entry carries its name, year, industry, whether it is verified and the exposed data categories (for example "Dates of birth"). Passwords are never returned.

Use cases

• Fraud prevention. A sign-up address with no footprint anywhere, a disposable domain and no breach history is a different risk from one with a decade of accounts. Use the email OSINT result as one signal in a review queue.
• Investigations and due diligence. See where an address is registered and which public identity sits behind it: a Gravatar name, location, job title and linked LinkedIn, X, GitHub or Instagram profiles.
• Security awareness. Check staff or customer addresses for breach exposure and see which categories of data leaked, without ever handling a password.
• Account takeover triage. A high breach count combined with many active accounts tells you which users to prompt for a password reset first.

Email OSINT compared with other tools

Open-source tools such as holehe answer one question per platform: is this address registered? Running them yourself means installing Python, keeping the modules working as sites change, and reading terminal output. This actor runs the same kind of account checks as a hosted batch job, and adds three things in the same run:

	This actor	A plain account checker	A breach checker
Accounts on 133 platforms	Yes	Yes	No
Name and linked profiles (Gravatar, GitHub)	Yes	No	No
Breach history with exposed-data categories	Yes	No	Yes
A–F risk score	Yes	No	Sometimes
Unknown kept separate from "no account"	Yes	Often not	Not applicable
Billing	Per account found	Varies	Per address

The distinction between unknown and "no account" matters most. A check that times out or is rate-limited is listed in accounts_unknown, so you never read a dead source as a clean negative.

Pricing

You are billed per found source, not per address. If an address turns up five sources, you pay for five. If it turns up nothing, there is no found-source charge. The existing actor-start fee still applies.

Use max_results_per_email to set a hard ceiling per address. It defaults to 25, which covers a typical address comfortably while stopping a heavily-used one from returning 80+ billable channels. When the cap truncates, direct email findings take priority over handle candidates. Within each group, rows that carry an identity (username, profile URL) are kept in preference, and the run reports that the channel limit was reached. FULL_RESULTS always holds the complete channel map, so nothing is hidden by the cap.

Event	Price	When it fires
Found source (main)	$0.0104	Once for each source an address was found on
Actor start	$0.00005	Per GB of run memory, minimum one event

Two things are never billed:

• Unknowns. A check that could not complete is not a found source.
• Unreliable sources. A check that cannot tell a real address from an impossible one never produces a finding, so it never charges.

Notes

• Checks that would send a login or recovery message, or create an account, remain unresolved. They do not produce a billed finding.
• The account scan runs for every valid address. Availability varies by platform; the unresolved-check list describes what could not be determined.
• Duration depends on source availability and the number of addresses. A lookup that exceeds its time budget is recorded as failed and does not bill.
• Use this for lawful investigation, fraud prevention, due diligence and security research only.

Free-plan limits

Users without a paid Apify plan receive at most ten channel rows across the entire run. The per-address limit is also bounded for those runs, including when the requested value is zero. The complete analysis remains available in FULL_RESULTS. Paid users retain the requested limit and can use zero for unlimited channel rows per address.

FAQ

Is this email OSINT lookup visible to the person being investigated?

No. No email is sent to the address, no account is created and no password reset is triggered. Checks that would require that are left unresolved.

How many addresses can I look up per run?

Up to five. Start several runs, or call the actor from the API in a loop, for longer lists.

What happens when no accounts are found?

The address produces no dataset rows and no found-source charges. Its completed analysis remains in FULL_RESULTS, and NO_RESULTS.addresses lists it.

Does unknown mean that no account exists?

No. It means the check did not produce a definitive answer. Unknown checks remain separate from positive and negative verdicts and are never billed.

Does limiting rows remove the full analysis?

No. The per-address channel limit applies to dataset rows. FULL_RESULTS retains the complete analysis, public identity, breach metadata and unresolved checks. Rows with a name or profile URL are preferred when the limit applies.

Optional handle follow-up

Enable follow_handles to check up to three distinct handles per address with Cross-platform Handle Checker. Handles come only from visible Gravatar verified accounts, GitHub commit authorship, or profile URLs from found accounts. Names and email address fragments are never guessed into usernames. Repeated evidence for the same handle is combined. The checker uses its current default site list, including new sites when its next release goes live.

Direct email findings carry _type: "email_account". Found profiles from the checker add rows with _type: "handle_presence", queried_handle, handle_origin, match_type: "handle_candidate", and email_link_verified: false. A matching username on another site is a candidate connection, not proof that the mailbox owner controls it. All checker responses are retained in FULL_RESULTS[].handle_checks, including summaries and negative results. Failed, blocked, or timed out checks are unknown, never "no account". Only newly found profiles add parent dataset rows. A profile that already proved the handle, or a platform already delivered as a direct email finding, adds no extra candidate row. Its complete check remains in handle_checks. The per-address result cap covers both original channels and added candidates, keeping direct email findings first; complete checks remain available in FULL_RESULTS even when those rows are capped.

Handle follow-up is available on Apify. Other API channels return the ordinary email results and a warning when follow_handles is enabled.

Handle follow-up pricing

This option is off by default and disabled for free-plan users. The checker runs on your Apify account with the token of this run. Its current price is $0.02 per handle plus $0.012 per checked platform. With the current ten sites, this is $0.14 per distinct handle, up to $0.42 per address for three handles. These child-run charges are additional to this Actor's existing $0.0104 per delivered dataset row and existing start fee. Child checks can incur charges even when they find no profile or cannot resolve a platform. No unknown check adds a charged row to this Actor's dataset. New checker sites or pricing can change the follow-up cost; consult the linked checker's current pricing.

max_results_per_email caps rows delivered here, not the cost of child checks already performed. A run with no verified handle starts no checker. Public profiles only; the option does not log in, create accounts, trigger recovery messages, or return breached data contents.