Check an email for exposure
Find where an address is registered, whether it appears in breaches, and what the address reveals about its owner.
- 01
Validate the address
Confirm the syntax and the domain’s mail records, and check for disposable or catch-all providers that indicate a throwaway.
Output: Whether the address is real and deliverable.
- 02
Registration footprint
Use an account-discovery service to see which platforms the address is registered on. This reveals the subject’s services without logging in.
Output: A platform list.
- 03
Breach exposure
Query breach corpora for the address to learn which incidents touched it and what data classes were exposed (passwords, addresses, IPs).
Output: Exposure timeline.
- 04
Gravatar and avatar pivots
Hash the address and check the global avatar directory — a returned image is both a face pivot and confirmation the address is in active use.
Output: A candidate avatar to reverse-search.
- 05
Document lawfully
Record only what your authorization covers, note the confidence of each finding, and avoid collecting credentials you have no basis to hold.
Output: A clean, scoped record.
Field notes
- A breach hit means data was exposed, not that the subject did anything wrong — write it that way.
- Catch-all domains accept mail to any address; a “valid” response there proves nothing.
- Never test credentials you find — possession and use are different legal questions.