How to investigate an email address

To investigate an email address, work outward in four passes. Read the address itself, check the domain it sits on, establish how long it has existed, and then find the accounts attached to it. Weigh every finding by how hard it would have been to fake, and keep every step passive: nothing in a sound investigation touches the account or tells its owner that someone is looking.

The rest of this piece goes through the passes in the order we run them, what each one is evidence of, and the mistakes that turn a good lead into a wrong answer.

Trust and safety queues, fraud alerts and investigation referrals tend to arrive with very little attached. A reported seller comes with the email on the account, and a tip sometimes names an address and nothing else.

Of the identifiers you are likely to be handed, the email address is usually the most useful to start from. People keep an address for years and use it to sign up for everything, so one address tends to sit underneath dozens of accounts its owner has forgotten about. It is also close to unique to one person. A username can be claimed by a stranger on any service where it happens to be free, and a phone number goes back into circulation when its owner lets it lapse. Google says a deleted Gmail address can't be used by anyone in the future. Not every provider works that way, which matters later.

Before any lookup, the string itself carries information.

The part before the @ often holds a name, a set of initials, a handle or a number. A two-digit number at the end is often a birth year or the year the address was made, and it is worth writing down as a hypothesis rather than a fact. A distinctive local part is a pivot: the same string as a username on other services is one of the first things to check.

Normalise before you compare anything. Gmail ignores dots in the part before the @, and it delivers mail sent to name+anything to the same inbox. So j.tarvelle84, jtarvelle84 and jtarvelle84+shop all reach one person. For a trust and safety team this cuts the other way too. An operator who opens ten accounts under ten spellings of one Gmail address looks like ten customers until someone normalises the column.

The domain sorts the address into one of three rough groups, and each needs different work.

A large free provider says little on its own, because most people use one.

A disposable or temporary-mail domain is a strong signal about intent at signup, because the address was made not to last. Community-maintained lists of these domains exist, and one widely used list on GitHub holds close to 9,000 of them. Treat a miss on a list as uninformative. New disposable domains appear faster than anyone can list them.

A custom domain is where most of the information is. Look up its registration date through RDAP, which ICANN made the definitive source for generic top-level domain registration data in January 2025, in place of WHOIS. Check whether it has mail records, whether it hosts a website, and whether that website agrees with what its owner has told you. An address on a domain registered three weeks ago, for a company that says it was founded in 2015, is a contradiction worth recording. Registrant details are usually redacted now, but the creation date almost always survives.

Age is the most useful single thing to know about an address, and there is nowhere to look it up. It has to be inferred from the traces the address has left.

Breach data is the strongest of those traces. If an address appears in the 2012 LinkedIn breach, it existed in 2012, whatever else turns out to be true about it. Date the address by when the breach happened, not when it surfaced: that one was stolen in 2012 and did not appear publicly until 2016. Have I Been Pwned lets you check an address against the breaches it indexes, and its API does the same for a single address with a paid key.

Absence runs the other way, more weakly. Most addresses that have been in everyday use for years have turned up in at least one breach. So an address that is supposedly old and heavily used, with no breach history at all, is unusual. The same empty history is completely normal for an address that is genuinely new, or that belongs to someone careful. It is a question to hold open, not an answer.

Other traces set a floor on age as well. The earliest archived page that mentions the address. The oldest public account that uses it. A Gravatar profile, which Gravatar looks up by a SHA-256 hash of the trimmed, lowercased address, so an address can be checked without contacting anyone. And old public commits: Git records the author's email in every commit, and on a public repository that metadata is public unless the developer has switched to a private noreply address.

This is the pass that turns an address into a person, and it is where most wrong answers come from.

Search for the exact address, in quotes, on general search engines. Search the local part as a username. Look for the address in the places people once posted it themselves: forum signatures, old classified listings, domain registrations from before redaction became standard, conference attendee lists, package registries and code.

Every hit needs one question answered before it goes into a report: is this the same person, and how do I know? An exact match on the full address is strong. A matching username on another service is much weaker, especially when the handle is short or common. A matching name is weaker still.

A few common techniques are best left out of a professional investigation.

Do not use other services' signup or password reset forms to test whether an address is registered there. Answering those forms differently for known and unknown accounts is a recognised weakness, and OWASP's guidance tells services to give the same response either way. Well-run services now do, so the results are unreliable. Some services also email the account holder about the attempt, which is the fastest way to tell a suspect that someone is looking, and the probing can breach the service's terms.

Do not try to verify an address by talking to its mail server. The SMTP standard lets servers switch off the command meant for checking an address, and in practice it is usually off. A server can also accept a recipient without deciding whether it exists, and a domain set up to take mail for any address will say yes to everything.

Never use a password from a breach, not even to confirm a match. Logging in with someone else's credentials is access nobody authorised, whatever the reason for doing it.

Passive methods also make better evidence. Something you found in a public record can be shown to a colleague, a customer or a court. Something you found by poking at a login form usually cannot.

The case below is a composite built from a common pattern. The names and addresses in it are invented, and example.com stands in for a large free mail provider that, like Gmail, ignores dots.

A marketplace's trust and safety team receives three buyer complaints about one seller in a week. The seller's phone number goes to voicemail, and the account has one email address: jonah.tarvelle84@example.com.

The address first. A first name, a surname and 84. The surname is rare, which makes a username pivot worth more than usual.

The domain says nothing by itself. Normalised, though, the address matches two other seller accounts on the same marketplace, both registered in the past month with the dots in different places. That moves the case from three complaints about one seller to three accounts behind one inbox.

Age. The address appears in two breaches, the older from 2016. Whoever controls it now, it has existed for at least a decade.

Attachments. The handle jtarvelle84 exists on a photography forum, with posts going back to 2015, from a city 200 miles from the seller's stated location. It also exists on a gaming site, created last year, with no activity. One of the old forum posts is a listing for a camera lens with the same email address written out in full.

That leaves two stories sitting on one address. A real person with a ten-year-old inbox and a long, unremarkable forum history. And a cluster of new marketplace accounts using that inbox this month. The shape fits a compromised or bought account better than it fits someone defrauding buyers under their own name. It proves neither, and the report says so: three facts, one confirmed connection, and one open question about who holds the inbox today.

Each pass is quick on its own. Run carefully, with every finding checked and sourced and the result written up, one address can easily take an experienced analyst the better part of an hour. That cost is the same whether the address turns out to matter or not, so busy teams ration it, and the rationing tends to fall on the cases that already looked suspicious.

Sixtyfour's agent runs the four passes from the address alone, in parallel, and returns what it found with a source attached to every finding: where the address appears, how old each trace is, which attached accounts it believes belong to the same person and why. It weights each hit the way this piece does, by how hard it would have been to manufacture. A reviewer gets something they can check rather than a score they have to trust. There is more on how this fits an investigation team's workflow on our investigations page.

Addresses change hands. Yahoo released dormant usernames for re-registration in 2013, and expired company domains put every address on them back up for grabs. A breach record from 2014 shows that the address existed then. It does not show that the person holding it now held it then.

Shared inboxes are common. Couples and families share addresses, small businesses run everything through one, and a role address like info@ belongs to whoever is working that day.

Common local parts mislead. A handle made of a first name and a number will match strangers on every large service. The rarer the string, the more a reuse match is worth.

Quiet results mislead as well. People who guard their privacy, who have just moved countries or who rarely post anything will all look thin. When a search comes back quiet, try a different identifier before reading anything into it.

Read the address, then the domain, then its age, then what is attached to it, and keep every step passive. Weigh each finding by how hard it would have been to fake, and mark what you could not establish as open. Handled that way, one address becomes a short list of sourced facts that a reviewer can check.