An email is a high-value selector: it links accounts, appears in breaches, and
often encodes a name. Input: one or more email addresses. Never send email to
the target as a research technique.
Confirm the address is real without messaging it: MX records for the domain,
SMTP/API validation services, and Gravatar (
https://gravatar.com/avatar/<md5>
— an existing avatar confirms use and often shows a photo/name). Parse the
local-part for a likely name pattern (
,
).
Done when the
address is graded valid/invalid/unknown and the name guess is noted.
Run
: Have I Been Pwned and breach datasets reveal which
services the address used, sometimes exposing reused passwords, usernames, and
personal fields to pivot from.
Done when breach appearances are recorded (or
none found).
Run
. Note validity, linked services, breach exposure, and the
identity the address maps to, each with a source.