OTInstaller
Dashboard

Email investigation playbook

Trace a suspicious message and find where an address is registered, without alerting its owner

Verified publisherbeginnerNeeds updateCommunity-packaged
osintverse-community/email-investigationLicense CC-BY-4.0About: Email

More than 20% of this guide's links no longer work, so parts of it may be out of date.

Tools used in this guide

  • osintverse-community/email-header-parser Parses raw email headers into senders, relay hops, IPs and SPF/DKIM/DMARC results
    ot install osintverse-community/email-header-parser
  • osintverse-community/checkdmarc Checks a domain's SPF, DMARC, MX, BIMI and DNSSEC records and reports problems
    ot install osintverse-community/checkdmarc
  • osintverse-community/dns-records Looks up a domain's A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records
    ot install osintverse-community/dns-records
  • osintverse-community/holehe Checks whether an email address is registered on 120+ sites, without alerting its owner
    ot install osintverse-community/holehe
  • osintverse-community/socialscan Checks whether a username or email address is in use on major platforms, accurately and quickly
    ot install osintverse-community/socialscan
  • osintverse-community/mailcat Finds existing email addresses for a nickname across 25+ mail providers
    ot install osintverse-community/mailcat

Install them all at once:

ot guide tools osintverse-community/email-investigation

Email investigation playbook

An email address is one of the strongest identifiers you can get: it is unique, people keep it for years, and most services use it for sign-up. This playbook covers two common cases:

  • A suspicious message (phishing, fraud, harassment): where did it really come from?
  • An address of interest: which services is it registered with, and what else does it lead to?

Steps

  1. Scope and legal
  2. Read the message headers
  3. Check the sender's domain
  4. Find registered accounts
  5. Pivot

Tools used (ot guide tools osintverse-community/email-investigation installs them all):

Tool Used for
osintverse-community/email-header-parser Senders, relay hops, IPs and authentication results
osintverse-community/checkdmarc The domain's SPF, DMARC and MX setup
osintverse-community/dns-records The domain's other DNS records
osintverse-community/holehe Sites where the address has an account
osintverse-community/socialscan Accurate checks on major platforms

Published 20 Oct 2026. Read offline: ot guide get osintverse-community/email-investigation · Source

Esc

Try

↑ ↓ to move↵ to open