Commercial real-time lookup of an email, phone, or username across hundreds of modules, with linked accounts, names, photos, and a timeline view.
fantastic reverse email lookup, good source count
selectors / email
address or domain mailbox · 43 tools · 17 free · 40 passive
playbooks starting here
/ search · jk move · ↵ open tool · i details
Commercial real-time lookup of an email, phone, or username across hundreds of modules, with linked accounts, names, photos, and a timeline view.
fantastic reverse email lookup, good source count
Browser-based OSINT search across 700+ modules. 400+ username platform checks, 330+ email enrichment modules, plus WHOIS, DNS and reverse-WHOIS for domains.
great reverse email lookup, great source count
Paid US background-check service covering contact info, criminal records, assets, vehicles, and social profiles.
Fast username and email lookup across 600+ sites using the WhatsMyName dataset, with PDF/CSV export and optional AI-generated profile summaries.
Free breach lookup by email, username, or phone that shows matching breaches and partial password hashes with source names.
One identifier in, one reconciled view out: runs an email, username, phone or domain across the OSINT APIs you hold keys for (OSI, Dehashed, Opsis) and merges results with per-source attribution.
Searchable breach database that queries by email, username, name, IP, phone, address, or password hash and returns raw leaked records.
Email verification service that checks syntax, domain, mailbox existence, and disposable-provider status. Has a limited free tier.
Recovers partial phone digits from the password-reset pages of services and builds candidate full numbers.
Reputation API for email addresses that reports age, breach exposure, social profiles, disposable/free provider status, and suspicious activity flags.
Web lookup for an email or phone that shows the linked Google account (name, photo, Maps reviews) and registrations on dozens of services.
Offensive Google framework that pulls the Gaia ID, profile photo, Maps reviews, public calendar, and linked services from a Gmail or Google Workspace address.
Fast regex search across half a million public GitHub repos. Find leaked config, internal hostnames, emails or API endpoints mentioning a target.
CLI that hunts for an email's breach exposure across multiple APIs (HIBP, DeHashed, Snusbase, IntelX, etc.) and local breach compilations.
Troy Hunt's free breach-notification service. Lists which known data breaches and pastes include an email address or phone number, but does not show passwords.
Checks whether a phone number or email appears in the 2021 Facebook scrape of 533M users, which links numbers to Facebook IDs and names.
Python CLI that checks whether an email address is registered on 120+ sites by abusing signup and password-recovery flows, without alerting the target.
decent free option, lacks in sources and has false positives
Free tools that check whether an email, username, or domain appears in infostealer-malware logs, with infection date and the compromised machine's details.
Finds professional email addresses for a company domain, infers the address pattern (e.g. first.last@), and verifies deliverability.
Search engine and archive of leaks, pastes, dark-web pages, and historical data. Supports email, domain, IP, CIDR, URL, and crypto address selectors.
Free email check from IPQualityScore that returns validity, disposable/abuse flags, leak status, and a fraud score.
Breach data search engine with a free check of which breaches contain a selector, and paid access to the full records.
Breach search by email, username, phone, or domain that shows breach sources and dates. Paid plans include leaked fields such as passwords.
Graph-based link-analysis platform. Run "transforms" against entities (people, domains, emails, companies) to pull data from dozens of integrated sources.
Intelligence X-powered search that lists email addresses, subdomains, and URLs seen for a given domain.
Enterprise identity-resolution search that links emails, phones, usernames, and names into person profiles from deep-web sources. Business accounts only.
Metasploit-style modular reconnaissance framework in Python, with a marketplace of modules and a built-in workspace database and reporting.
Global database of reported scammer emails, phones, usernames, and crypto addresses submitted by victims and researchers.
Source code search engine indexing code from GitHub, GitLab, Bitbucket and other forges. It complements grep.app with broader coverage beyond GitHub.
Free US people search with address history, phones, emails, and relatives. Useful for cross-checking other broker sites.
Search engine of email addresses indexed from the web. Enter a domain to list addresses and the pages where they appeared.
Paid breach search engine with a large indexed corpus, searchable by email, username, name, IP, password, or hash, with hash lookup.
Paid identity-verification search by name, email, phone, username, or image, aimed at romance-scam and catfish investigations.
Checks whether a username or email is registered on major platforms (Instagram, X, GitHub, Snapchat, etc.) using signup/reset endpoints for accurate results.
OSINT automation framework with 200+ modules. Give it a domain, IP, email, name or username and it recursively correlates findings in a web UI.
Paid US people search with strong email and username to person matching and social profile aggregation.
Free US reverse lookup for phone numbers, names, addresses, and emails. Historically it could also play a number's voicemail greeting.
Free US lookup by name, address, phone, email, IP, or VIN that returns linked identities and contact details.
Paid US background reports that aggregate public records, contact details, criminal history, and social media.
Free SMTP-level check of whether a mailbox exists, without sending an email.
Swiss-army collection of DNS tools including reverse IP, reverse WHOIS, IP history, DNS records, reverse MX/NS and port checks.
Guesses and verifies a person's work email from their name and company domain.
WHOIS lookup with cheap historical WHOIS and reverse WHOIS by registrant name, email, company or keyword.
0 results. Try loosening the filters or a different term.