How to Find Accounts Linked to an Email Address

Before you start: write down the question

Every good email investigation starts with one sentence on a sticky note. "Is this applicant's address a real, long-standing personal address?" leads to five focused checks. "What is this person's whole online life?" leads to hours of collecting things you can't justify keeping, which is wasteful and, under the GDPR, hard to defend.

So name the decision the research feeds (approve the payout, escalate the case, verify a source) and stop when you can make it. If the address belongs to someone else, make sure you have a lawful reason; our OSINT legal and ethics guide covers what that means day to day.

Throughout this guide we use the fictional address jane.doe@example.com.

The pivot map

Here is the whole method on one page. You start at the address, fan out into three kinds of source, collapse back into a handful of usernames and profile details, and then verify before you conclude.

The steps below follow the diagram from top to bottom. In practice you'll run the first four at once, which is exactly what a combined email search does.

Step 1: Check that the address is real

There's no point mapping accounts for an address that can't receive mail. A deliverability check tells you whether the domain has MX records, whether the mail server accepts this mailbox (where it's willing to say), whether the domain is a known disposable provider, whether it's a role account like info@, and whether it's a catch-all domain that accepts anything.

A disposable or catch-all result doesn't end the investigation, but it changes how much weight later findings get. The mechanics, including the SMTP conversation, are in how to verify an email address without sending mail.

Step 2: Check where the address is registered

Many sites reveal whether an email is already in use. Sign-up forms say "this email is already registered", and password reset pages behave differently for known and unknown addresses. Open source tools such as holehe automate this across many sites, and TraceFind's email search does it for 296 sites. Done properly it's passive: no reset email is sent and the account owner sees nothing.

What a registration hit does and doesn't tell you:

• Presence, not activity. An account was created with this address at some point. It may have been dormant for a decade.
• Context. Developer platforms, a fitness app and a marketplace paint a different picture from gaming and streaming sites.
• Pivots. Some sites expose a partial username, a display name or the last digits of a phone number during the check.

Step 3: Look the address up in breach data

Breach records answer two questions registration checks can't: when the address was in use and which data was attached to it. A breach lookup returns the breached service, the breach date and the exposed data types, such as email, username, name, phone number, IP address or password hash. Have I Been Pwned is the best-known free source; TraceFind searches more than 16 billion breach records from several sources in the same pass as the registration check.

For an investigator, three things in that breach card matter:

• Dates. An address in a breach from several years ago existed then. That is strong evidence against a freshly made identity.
• Linked usernames. Breaches often pair the email with the username used on that service, a reliable input for a username search.
• Services. The list of breached sites is a second view of where the person had accounts.

Don't use leaked passwords, hashed or not, to access anything. If you're checking your own address, read what to do after a data breach instead.

Step 4: Check avatars and Google account details

Gravatar links a profile picture, and optionally a public profile, to an email address. The avatar URL is built from a hash of the trimmed, lowercased address (historically MD5, now also SHA-256), so you can check it yourself:

# hash the normalised address
printf '%s' 'jane.doe@example.com' | tr 'A-Z' 'a-z' | shasum -a 256
# then open https://gravatar.com/avatar/<hash>?d=404
# a 404 means no Gravatar is set for that address

If an avatar exists, the same image often turns up on forums, code hosts and comment sections, which makes it a good link between accounts. A reverse image search can surface more.

Google accounts. Gmail addresses, and many custom domains on Google Workspace, belong to a Google account, and some details such as a public profile picture can be visible. TraceFind's email search shows linked Google account details where they're public.

Step 5: Read the domain and the local part

The part after the @ often says more than the part before it.

The local part is worth a look too. jane.doe suggests a real name; jdoe-dev is a handle that is probably reused as a username elsewhere. Try the handle as a username before you assume anything about it.

Step 6: Pivot to usernames and profiles

By now you usually have one to three candidate usernames: from the local part, from breach records, from registration details. Run each through a username search, which checks many sites for a profile with that exact handle. TraceFind's username search covers about 1,000 sites and pulls profile fields such as display name, bio and avatar where a site exposes them.

This is where cases get crowded, and a list stops being enough. Putting the address, the usernames and the profiles on an investigation canvas shows you at a glance which findings hang off which identifier. Our username OSINT guide goes deeper on this hop.

Step 7: Grade every finding before you conclude

The most common email OSINT mistake is treating every hit as confirmed. jdoe-dev on a code host might be Jane, or one of the many other J. Does who had the same idea. We grade each finding with three questions, in this order:

"Independent" matters. A username and a display name derived from it count as one attribute, not two. An avatar, a location in the bio, a linked website or the same writing style are separate signals.

A worked case: the €2,400 payout

Now flip it. If the same check had come back with a throwaway inbox, zero registrations and no breach history at all, none of that proves fraud, but it does mean the identity has no past you can see. That's the moment to ask for more verification rather than pay out.

A long breach history is boring, and boring is exactly what a real person looks like.

Mistakes we see most often

Frequently asked questions