Email Investigation
Email Intelligence & OSINT
Email Investigation answers a single question well: what is publicly known about this address, and how much of it is a risk?
Every signal Email Investigation pulls
Breach database lookup
Disposable email detection
MX record validation
Social profile linkage
Reputation scoring
Threat intelligence feeds
Who reaches for this engine
Checking whether a specific email address appears in a known breach before trusting it with anything sensitive.
Deciding if an address should be accepted, bounced or blocked, using MX validity, disposable-provider detection and reputation signals together.
Investigating a suspicious message by linking the sender address to the public profiles and infrastructure around it.
Under the hood
Analyzes email addresses for breach exposure, disposable detection, MX record validation, social profile linkage, and reputation scoring across threat intelligence feeds and public data sources.
Questions about Email Investigation
- How do you check if an email has been breached?
- The address is matched against known breach and credential-dump datasets, and the result distinguishes between a record in a genuine breach, a record from a low-quality or spam list, and no match at all. A hit in a curated dataset means credentials for that address were exposed and should be treated as compromised.
- What is disposable email detection?
- It identifies addresses registered to temporary or throwaway mail providers. These matter for two reasons: they are heavily used for throwaway account creation and fraud, and they are frequently blocked, so an address that fails the check may simply be unreachable for anything time-sensitive.
- Does Email Investigation show me the person's passwords?
- No. OsintX never returns credentials. It reports that exposure happened, which dataset it came from, and what that implies — so an address can be flagged for a password reset without the platform ever holding the password itself.
- What is MX record validation?
- Mail exchange (MX) records define which servers accept mail for a domain. The check confirms those records actually exist, because a syntactically valid address on a domain with no mail infrastructure cannot be a deliverable contact — and is a common sign of a fabricated or throwaway identity rather than a real inbox.
- How does social profile linkage work?
- The address is matched against public profiles and pages that reference it. A real, active contact usually surfaces a small public footprint of linked accounts, while one that exists only on paper tends to come back empty — which is itself a signal when you are deciding whether to trust the sender.