Investigate an email address

Find out whether an address is real, which accounts it is tied to, and who may be behind it.

Starts with
Email address
Useful for
Suspicious senders, scam contacts, due diligence on a new contact.
Time
20–45 minutes
Progress
0 of 6 steps ·

Type a value into any step and every step of the same type fills in, with direct search links. Values stay in this tab and are not saved; only which steps you ticked is remembered, in your browser.

  1. 1. Check the address exists

    Why: Scammers often use addresses that bounce or were created minutes ago. A dead address changes the whole investigation.

    Do: Verify the mailbox exists and whether the domain accepts every address (catch-all), which makes the check less reliable.

    Look for:
    • Whether the mailbox is deliverable
    • Disposable or free-mail providers

  2. 2. Look at the domain behind it

    Why: For a company address, the domain tells you whether the company is real and how long it has existed.

    Do: Take the part after the @ and check its age, reputation and the company's usual address pattern.

    Look for:
    • A domain registered very recently
    • A mismatch with the company's real address pattern (for example first.last@)

  3. 3. Find accounts registered to it

    Why: Accounts on other services often reveal a name, photo, location or username.

    Do: Run the address through account-discovery tools. Confirm every hit by hand before relying on it.

    Look for:
    • A Google account with a public name, photo or Maps reviews
    • Social accounts that confirm the address is in use

  4. 4. Check for known breaches

    Why: Appearing in breaches shows the address is old and real, and the breach names hint at the person's interests.

    Do: Check breach notifications only. Do not look for or use the leaked data itself.

    Look for:
    • How many breaches and from which years
    • Services that suggest a country, profession or interest

  5. 5. Search for it in the open

    Why: Addresses published on websites, forums, PGP key servers or domain registrations connect to a name.

    Do: Search the exact address in quotes on search engines, then check reverse WHOIS for domains registered with it.

    Look for:
    • Domains registered with the address
    • A name next to the address on a public page or key

  6. 6. Pivot on the username

    Why: The part before the @ is often reused as a username elsewhere.

    Do: Take the local part (before the @) and search it as a username.

    Look for:
    • Profiles with the same photo or name as the accounts from step 3

Other playbooks