Email OSINT with Holehe and Epieos: How to Find Anyone From a Single Address
Give a trained investigator one email address and, within an hour, they can often tell you the person’s real name, their profile photo, which social and shopping sites they use, which data breaches they have been caught in, and roughly where they live. No hacking. No contact with the target. Just public information, pulled together with the right tools in the right order.
That is email OSINT, and this post is the exact workflow, built around the two tools that do most of the heavy lifting: Holehe and Epieos. Six steps, the tooling for each, and a clear line on where this stops being legal.
That line matters, so it goes first. OSINT is open source intelligence: information that is already public, gathered passively, without ever contacting or deceiving the target. The moment you log into an account, trigger a password reset to confirm an address, or trick someone into revealing something, you have left OSINT and entered unauthorised access, which is a crime under the Information Technology Act in India and comparable laws everywhere. Everything below is for authorised investigations, security reconnaissance, and your own accounts.
What one email actually gives away
People think of an email as a private channel. For an investigator it is the opposite: it is a public key that unlocks everything registered against it.
- The text before the @ is often reused as a username on other platforms
- It is tied to a Google or Microsoft identity, which carries a real name and photo
- It is registered on dozens of sites, each one a data point
- It appears in breach dumps that reveal old passwords and username habits
The skill is not finding one of these. It is pulling the thread methodically so each finding leads to the next.
Step 1: Start with the email itself
5 minutes, before any tool
Spend a few minutes understanding what you are holding. It shapes everything after.
- The local part is a username lead.
jdoe_photography@gmail.com tells you to go looking for the handle jdoe_photography elsewhere
- Normalise it. Gmail ignores dots and anything after a plus sign, so
john.doe+netflix@gmail.com and johndoe@gmail.com reach the same inbox. Do not treat them as different people
- Read the domain. Personal, corporate, educational, or disposable. Each implies a different investigative path
- Set a goal. Verifying an identity, investigating a scam, or mapping a pentest target are three different jobs
Checkpoint: you can state in one line what you are trying to establish and why this address is a useful starting point.
Step 2: Map linked accounts with Holehe
The one tool to learn first
If you only ever learn one email OSINT tool, make it Holehe. Feed it an email and it checks over 120 websites to see whether an account exists for that address, and it does so silently.
Why Holehe is the standout
- Coverage. More than 120 sites in a single run, from social media to shopping to developer platforms
- Silent. It does not send a password reset or anything else the target would ever see
- Fast. One command returns a map of where that email is registered
- Signal rich. Knowing someone has an account on a specific platform is the pivot to your next step
How it works, briefly
Holehe uses each site’s sign up and forgotten password flows to detect whether an account exists for the email, reading the response without completing any action. It confirms that an account is there. It never accesses it. That distinction is the whole reason it stays on the right side of the line.
Checkpoint: run Holehe against an email you own and read the list of platforms it is and is not registered on.
Step 3: Pull an identity report with Epieos
The all in one lookup
Holehe gives you breadth across many sites. Epieos gives you depth on one identity. It is a web based all in one email lookup that frequently turns a bare address into a real person.
What Epieos can surface
- Google account details. The name on the account, the profile photo, and the Google ID
- Google Maps activity. Public reviews and saved places, which sometimes include photographs of the person or their surroundings
- Public calendar. Events tied to the account when they are not private
- Linked services. Other platforms connected to the same address
A Google ID, a profile photo, and a handful of map reviews is often enough to attach a real face and a rough location to what started as plain text. This is the step where an address becomes a person.
Checkpoint: run an email you own through Epieos and interpret what it returns about the associated Google identity.
Step 4: Check breach data
Public history
Data breaches are, for better or worse, public record now. Checking whether an email appears in them tells you which services the person used and, more usefully, the usernames and password patterns they reuse.
- Have I Been Pwned. The free standard for checking which known breaches include an email
- Breach aggregators. Paid services dig deeper and sometimes expose specific leaked fields
- Reuse patterns. An old leaked username or a password habit often carries straight across to current accounts
One hard rule: reviewing that an email appears in a breach is OSINT. Taking a leaked password and logging in with it is a crime. The value here is understanding habits and patterns, never reusing credentials.
Checkpoint: check an email against breach data and explain what the results suggest about the person’s habits, without misusing anything you find.
Step 5: Verify and enrich
1 hour
A single tool gives you leads. Real investigation confirms each lead against two more sources and expands outward from the email.
- Validate the mailbox. Confirm the address is deliverable before building a case on it
- Gravatar. Many emails have an avatar tied to the address hash, an easy identity link
- Pivot to usernames. Feed the local part and any handles you found into Sherlock or Maigret to find matching accounts across platforms
- Cross check. A finding from one source is a guess. Confirmed by three, it is a fact
Checkpoint: for each key finding you have at least two independent sources that agree, and you can tell a confirmed fact from an unverified lead.
Step 6: Document it legally
Every single case
Professional OSINT is not just finding things, it is recording them lawfully and defensibly. This is the difference between an investigator and a stalker, and it is not optional.
- Stay in scope. Only investigate within an authorised, lawful purpose
- Cite every source. Each finding names where it came from and when
- Stay passive. Never log in, never reset, never social engineer. Public and passive only
- Record confidence. Label each finding confirmed or probable, with timestamps and screenshots
The techniques in this post are neutral. The purpose is what makes their use right or wrong. Using them to harass, stalk or target a private individual is illegal and causes real harm. Using them for authorised investigation, fraud detection, journalism or security work is legitimate and valuable.
The toolkit at a glance
| Tool | What it does |
|---|
| Holehe | Checks 120 plus sites for accounts linked to an email, silently |
| Epieos | All in one lookup, surfaces Google identity, maps and calendar |
| Have I Been Pwned | Which known breaches include the email |
| Gravatar | Avatar tied to the email address hash |
| Sherlock and Maigret | Username search across many platforms |
| Hunter.io | Email formats and addresses for a company domain |
Frequently asked questions
Is email OSINT legal?
Gathering public information passively is legal in most jurisdictions, including India. It becomes illegal the moment you log into an account, reset a password, or deceive someone. Stay public and passive, for a lawful purpose.
What is the single best email OSINT tool?
Holehe for most people, because mapping an email to accounts across a hundred plus sites silently is usually the most useful first result. Epieos is the strongest companion for identity details.
Will the person know I looked them up?
With proper passive tools like Holehe and Epieos, no. They read public signals and account existence without sending anything the target sees. This is exactly why you never use password resets to confirm an email.
Do I need to pay?
The core workflow is free. Holehe is open source, Epieos has a free tier, and Have I Been Pwned is free to check. Paid aggregators add depth but are not required to start.
Can I find someone’s home address from an email?
Usually not directly, and you should be careful even trying. Email OSINT reveals linked accounts, identity and activity. Attempting to pinpoint and act on a private person’s location can cross into stalking, which is illegal.
How is this used in a pentest?
During reconnaissance, testers map an organisation’s email formats and exposed accounts to understand the human attack surface, strictly within the authorised scope of the engagement.
The honest closing
The uncomfortable thing about email OSINT is how little effort separates the first result from a full profile. Two free tools and twenty minutes is often enough to go from an address to a face. That is exactly why learning it properly matters, in both directions.
As an investigator, it is one of the highest leverage skills in security, used daily in fraud, due diligence and reconnaissance. As a target, understanding it is the reason you use different usernames, a password manager, and an alias email for throwaway signups.
Run Holehe and Epieos against your own email first. Seeing your own footprint laid out is the fastest way to understand both the power of the technique and the reason to use it responsibly.
The OSINT labs on Hacklido let you practise this workflow against safe, intentional targets instead of real people, which is exactly where you should build the skill before it ever touches a live investigation. Publishing your own OSINT writeups there is also a strong way to show the methodology, not just the result.
