Data Points

📧 Email Address

🔧 Native workbench

🔎 Live indicators (IoC view)

🔗 Analyst pivots

🔌 Sources that yield Email Address (2)

🧭 Disciplines

🎯 Mission Domains

🔍 Lookup

📜 Playbook — Email Address exploitation

1. Direction — frame the requirement for Email Address: what decision does this support, by when?
2. Collection — pull the 2 mapped sources (1 free) and the native workbench (open); capture provenance and observe OPSEC.
3. Processing — normalize, de-duplicate and enrich the collected data.
4. Analysis — correlate against local holdings; apply ACH; assign confidence.
5. Dissemination — open a case, draft a report, share via STIX/MISP.
6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

✨ Enrichment pathways

🎫 Email Address

An email address is a routable identity selector composed of a local part and a domain, used as a login, contact, and account-recovery anchor across services. It is a high-value pivot in investigations because a single address ties together breach exposures, account registrations, and infrastructure ownership.

Format: RFC 5322 local-part@domain; validate syntax, then MX/domain existence and disposable/free-provider classification. Normalize gmail dots and plus-addressing for dedup.

📡 How it is collected

• Data breach and credential-dump corpora
• WHOIS / domain registration records
• Website scraping and contact pages
• Account registration and password-reset probing
• Social profile and API metadata
• Git commits and code-repository authorship

📚 Enrichment & validation sources

🔗 Pivot to

🧩 Analysis & hunting techniques

• Breach-corpus correlation and password reuse analysis
• Account-existence enumeration across services (Holehe/Sherlock-style)
• Local-part pattern analysis to derive naming conventions
• MX and disposable-provider classification
• Gravatar/avatar and profile linkage
• Plus-address and catch-all detection
• WHOIS reverse-lookup for owned infrastructure
• Reputation/deliverability scoring

🔧 Tools

• Holehe
• theHarvester
• h8mail
• Maltego
• SpiderFoot
• Mosint
• GHunt
• MXToolbox

⚡ Workbench actions

• Check breach exposure (HIBP/DeHashed)
• Enumerate accounts across services
• Validate MX and disposable status
• Pivot to registered social profiles
• Reverse WHOIS for owned domains
• Resolve Gravatar/avatar linkage
• Score deliverability and reputation
• Export selectors to correlation engine

📊 Dashboard KPIs

📂 Open