Email OSINT Lookup - Apify Actor

Email OSINT tool for cybersecurity professionals and investigators. Validates emails, detects accounts across 21+ platforms, checks breach history, and provides risk scoring.

Data Sources

The actor checks email presence across the following platforms and data sources:

Identity & Authentication

Platform	Data Returned
Microsoft	Account exists, domain type (consumer/o365_tenant/unmanaged), tenant info
Apple	Account exists
Office365	Account exists

Social Media

Platform	Data Returned
Twitter/X	Account exists
Instagram	Account exists
Snapchat	Account exists
LinkedIn	Account exists
Tumblr	Account exists

Developer Platforms

Platform	Data Returned
GitHub	Account exists, username, profile URL
Gravatar	Account exists, profile URL
WordPress	Account exists

Communication & Entertainment

Platform	Data Returned
Discord	Account exists
Spotify	Account exists
Deezer	Account exists

E-Commerce & Delivery

Platform	Data Returned
Amazon	Account exists
eBay	Account exists
Deliveroo	Account exists

Media & Productivity

Platform	Data Returned
Imgur	Account exists
Adobe	Account exists

Education & Browsers

Platform	Data Returned
Duolingo	Account exists
Firefox	Account exists

Email Analysis

Check	Description
Format validation	RFC-compliant email format check
Disposable detection	Identifies temporary/throwaway email providers
Free provider detection	Gmail, Yahoo, Outlook, etc.
Business email detection	Corporate domain identification
Role account detection	info@, admin@, support@, etc.
Name extraction	Name hints derived from email local part

Security Intelligence

Check	Description
Breach detection	Whether the email appeared in known data breaches
Breach count	Number of breaches found
Breach details	Names, dates, and domains of breaches
Risk scoring	A-F risk scale based on exposure and activity

Setup

$source .venv/bin/activate && uv pip install -r requirements.txt

Usage

Apify Actor

$apify run --input '{"emails": ["user@example.com"]}'

CLI

# Single email
python -m src.main lookup user@example.com

# Multiple emails
python -m src.main lookup email1@test.com email2@test.com --concurrency 5

# Output to file
python -m src.main lookup user@example.com --output results.json

# Explicit API key
python -m src.main lookup user@example.com --api-key your_key

Input Schema (Apify)

Field	Type	Required	Default	Description
emails	string[]	Yes	—	Email addresses to investigate
max_concurrency	int	No	10	Concurrent requests (1-10)

Output

Each email produces a result with:

{
    "email": "test@example.com",
    "success": true,
    "error": null,
    "analysis": {
        "valid_format": true,
        "local_part": "test",
        "domain": "example.com",
        "tld": "com",
        "is_disposable": false,
        "is_free_provider": false,
        "is_business_email": true,
        "is_role_account": false,
        "name_hints": ["Test"]
    },
    "accounts": {
        "github": true,
        "twitter": true,
        "spotify": true,
        "linkedin": true,
        "amazon": true,
        "tumblr": true,
        "office365": true,
        "duolingo": true,
        "deezer": true,
        "gravatar": false,
        "adobe": false,
        "instagram": false,
        "discord": false,
        "snapchat": false,
        "wordpress": false,
        "firefox": false
    },
    "breach_info": {
        "breached": null,
        "breach_count": 0,
        "breaches": []
    },
    "summary": {
        "accounts_found": 9,
        "accounts_checked": 17,
        "is_active_email": true,
        "risk_score": "D"
    },
    "processing_time_seconds": 3.1
}

Account Values

Value	Meaning
true	Account confirmed to exist
false	Account confirmed to not exist

Platforms where the result is inconclusive are omitted from the output.

Risk Score Scale

Score	Meaning
A	Low risk — minimal online presence
B	Moderate — some accounts found
C	Elevated — significant online presence
D	High — many accounts, possible breaches
F	Critical — extensive exposure