Email & Phone Recon
What an email address or phone number can reveal — and where the hard privacy walls are.
An email or phone number is a pivot point: it can link accounts, hint at an employer, or confirm a real name. But most platforms now deliberately leak very little, so treat every result as a weak signal.
Email addresses
- Breach-corpus checkers (Have I Been Pwned and similar) tell you which breaches an address appears in — never the passwords themselves.
- Gravatar and account-recovery flows can confirm whether an address is registered on a service.
- The domain reveals employer, school, or host (Gmail, ProtonMail, a custom domain).
- Verification should rely on the account, not the address: an address alone proves little.
Phone numbers
- Carrier and line type are usually derivable from the number itself (prefix, country code).
- Messaging apps (WhatsApp, Signal, Telegram) can reveal a profile name and avatar when the number is registered — but doing so can notify the user depending on their settings.
- Reverse-lookup services are hit-and-miss and often resell stale data; corroborate before trusting.
A phone number is personal data under GDPR-style regimes. Collecting and storing it requires a lawful basis; storing it in a case file you share can create real liability.
The classic mistake is over-attributing: "the number is on a business listing, therefore the target owns the business." Listings go stale and numbers get recycled. State the link and its confidence, not the conclusion.
Headers tell the truth
If you have an actual email (not just the address), the message headers are a richer source than the address. They carry the sending infrastructure, the route between servers, and often the client that composed it — none of which the sender can easily edit without breaking delivery.
# Pull the routing and auth fields from a saved .eml
# (from the raw message source in your mail client)
grep -Ei "^(Received|Return-Path|Message-ID|Authentication-Results|X-Mailer|From|Reply-To):" message.eml
# Then resolve the origin infrastructure
dig +short origin-ip.example.net
dig +short -x 203.0.113.10Your only lead is a mobile number appearing on a marketplace profile.
Method · Determine country and carrier from the prefix and look up the number's portability and line type. Check whether it is registered on any messaging app — from a sock puppet, and only where the app will not notify the user. Cross-reference the number against public business listings and the handle used on the marketplace account.
Result · The number resolves to a registered messaging profile whose avatar matches the marketplace seller, and an old business listing pairs the number with a first name — reported as a probable link at medium confidence, with the caveat that numbers get recycled.