{"namespace":"osintverse-community","name":"email-investigation","kind":"guide","summary":"Trace a suspicious message and find where an address is registered, without alerting its owner","latest_version":"1.0.0","categories":["email"],"inputs":["email"],"outputs":[],"runtime":null,"stars":0,"installs_30d":0,"health":"unknown","health_checked_at":null,"verified":true,"signed":false,"needs_keys":false,"manifest_held_by_registry":false,"community_packaged":true,"source_unavailable":false,"status":"published","title":"Email investigation playbook","level":"beginner","format":"guide","language":"en","needs_update":false,"ref":"osintverse-community/email-investigation","version":"1.0.0","published_at":1792513203878,"license":"CC-BY-4.0","topics":["email"],"repo_url":"https://github.com/osintverse-community/email-investigation","homepage":"https://github.com/osintverse-community/email-investigation","nav":[{"path":"index.md","title":"Email investigation playbook","words":131,"dead_links":0},{"path":"01-scope-and-legal.md","title":"Scope and legal","words":165,"dead_links":0},{"path":"02-headers.md","title":"Read the message headers","words":207,"dead_links":0},{"path":"03-domain.md","title":"Check the sender's domain","words":193,"dead_links":0},{"path":"04-accounts.md","title":"Find registered accounts","words":189,"dead_links":0},{"path":"05-pivot.md","title":"Pivot","words":138,"dead_links":0}],"related_tools":[{"ref":"osintverse-community/email-header-parser","available":true,"install":"ot install osintverse-community/email-header-parser","namespace":"osintverse-community","name":"email-header-parser","kind":"tool","summary":"Parses raw email headers into senders, relay hops, IPs and SPF/DKIM/DMARC results","latest_version":"0.1.0","categories":["email"],"inputs":[],"outputs":["domain","email","ip"],"runtime":"docker","stars":0,"installs_30d":0,"health":"healthy","health_checked_at":1792565598714,"verified":true,"signed":true,"needs_keys":false,"manifest_held_by_registry":false,"community_packaged":true,"source_unavailable":false,"status":"active","ethics":{"touches_target":false,"auth_required":false,"collects_personal_data":true},"egress":false},{"ref":"osintverse-community/checkdmarc","available":true,"install":"ot install osintverse-community/checkdmarc","namespace":"osintverse-community","name":"checkdmarc","kind":"tool","summary":"Checks a domain's SPF, DMARC, MX, BIMI and DNSSEC records and reports problems","latest_version":"6.0.4","categories":["email","domain-dns"],"inputs":["domain"],"outputs":["dns_record","domain"],"runtime":"pipx","stars":0,"installs_30d":0,"health":"healthy","health_checked_at":1792565678640,"verified":true,"signed":true,"needs_keys":false,"manifest_held_by_registry":false,"community_packaged":true,"source_unavailable":false,"status":"active","ethics":{"touches_target":false,"auth_required":false,"collects_personal_data":false},"egress":true},{"ref":"osintverse-community/dns-records","available":true,"install":"ot install osintverse-community/dns-records","namespace":"osintverse-community","name":"dns-records","kind":"tool","summary":"Looks up a domain's A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records","latest_version":"0.1.0","categories":["domain-dns"],"inputs":["domain"],"outputs":["dns_record","domain","ip"],"runtime":"docker","stars":0,"installs_30d":0,"health":"healthy","health_checked_at":1792565543258,"verified":true,"signed":true,"needs_keys":false,"manifest_held_by_registry":false,"community_packaged":true,"source_unavailable":false,"status":"active","ethics":{"touches_target":false,"auth_required":false,"collects_personal_data":false},"egress":true},{"ref":"osintverse-community/holehe","available":true,"install":"ot install osintverse-community/holehe","namespace":"osintverse-community","name":"holehe","kind":"tool","summary":"Checks whether an email address is registered on 120+ sites, without alerting its owner","latest_version":"1.61.0","categories":["email"],"inputs":["email"],"outputs":["account"],"runtime":"docker","stars":0,"installs_30d":0,"health":"healthy","health_checked_at":1792565639620,"verified":true,"signed":true,"needs_keys":false,"manifest_held_by_registry":false,"community_packaged":true,"source_unavailable":false,"status":"active","ethics":{"touches_target":false,"auth_required":false,"collects_personal_data":true},"egress":true},{"ref":"osintverse-community/socialscan","available":true,"install":"ot install osintverse-community/socialscan","namespace":"osintverse-community","name":"socialscan","kind":"tool","summary":"Checks whether a username or email address is in use on major platforms, accurately and quickly","latest_version":"2.0.1","categories":["username","email","social-media"],"inputs":["username"],"outputs":["account"],"runtime":"pipx","stars":0,"installs_30d":0,"health":"healthy","health_checked_at":1792565678640,"verified":true,"signed":false,"needs_keys":false,"manifest_held_by_registry":false,"community_packaged":true,"source_unavailable":false,"status":"active","ethics":{"touches_target":false,"auth_required":false,"collects_personal_data":true},"egress":true},{"ref":"osintverse-community/mailcat","available":true,"install":"ot install osintverse-community/mailcat","namespace":"osintverse-community","name":"mailcat","kind":"tool","summary":"Finds existing email addresses for a nickname across 25+ mail providers","latest_version":"0.1.1","categories":["email","username"],"inputs":["username"],"outputs":["email"],"runtime":"pipx","stars":0,"installs_30d":0,"health":"healthy","health_checked_at":1792565678640,"verified":true,"signed":false,"needs_keys":false,"manifest_held_by_registry":false,"community_packaged":true,"source_unavailable":false,"status":"active","ethics":{"touches_target":false,"auth_required":false,"collects_personal_data":true},"egress":true}],"checks":{"needs_update":false,"dead_link_ratio":0,"links":{"checked":10,"dead":3,"missing":0,"malicious":0,"unchecked":0,"skipped":0,"dead_links":[{"page":"02-headers.md","line":28,"url":"https://otinstaller.com/guides/osintverse-community/ip-investigation","status":"dead","http_status":404},{"page":"05-pivot.md","line":6,"url":"https://otinstaller.com/guides/osintverse-community/username-investigation","status":"dead","http_status":404},{"page":"05-pivot.md","line":12,"url":"https://otinstaller.com/guides/osintverse-community/ip-investigation","status":"dead","http_status":404}],"url_scanner":"checked","url_scans":[{"url":"https://otinstaller.com/guides/osintverse-community/domain-investigation","verdict":"clean","error":null}]}},"manifest":{"schema":1,"kind":"guide","name":"email-investigation","namespace":"osintverse-community","version":"1.0.0","title":"Email investigation playbook","summary":"Trace a suspicious message and find where an address is registered, without alerting its owner","license":"CC-BY-4.0","homepage":"https://github.com/osintverse-community/email-investigation","categories":["email"],"level":"beginner","format":"guide","language":"en","content":{"root":"docs/","nav":["index.md","01-scope-and-legal.md","02-headers.md","03-domain.md","04-accounts.md","05-pivot.md"]},"related_tools":["osintverse-community/email-header-parser","osintverse-community/checkdmarc","osintverse-community/dns-records","osintverse-community/holehe","osintverse-community/socialscan","osintverse-community/mailcat"],"topics":["email"]}}