Enter an email address to analyze breach history and security risks
Nothing searched yet

Email Address lookup

Breach exposure and linked identity information for an address, for use in an authorised security investigation -- typically incident response or an account-compromise case.

For authorised security investigations only, on accounts you are responsible for. This returns information about a person -- have a reason before you search. See acceptable use.

What you can paste

These are format examples. Clicking one puts it in the search box — it does not run a search, so you choose when to spend a lookup.

How to run one
  1. 1Paste the email address into the box above. The type is already set to Email Address on this page.
  2. 2Press Analyze. If the indicator is new to the platform it is queued for enrichment, and the page holds a progress view while that runs rather than telling you to come back later.
  3. 3Read the report top-down. The verdict is the headline; the sections below it are the evidence, and the evidence is the part worth your time.
  4. 4Pivot. Almost every value in the report is itself searchable, which is how one indicator becomes an investigation.
Where to go next
  • Search any linked phone number
  • Search linked IP addresses as indicators
  • Correlate the exposure dates against your own incident timeline
Cross-referenceThreat huntingDo this by API
What comes back, and how to read it

These are the sections of the report, in the order you will meet them.

  1. 01Risk Score and Threat Level

    The aggregate assessment for the address. Driven largely by how much exposure exists and how recent it is.

  2. 02Recent Breach Activity

    The known incidents this address appears in, with first seen, last seen and reported dates. Recency matters more than count -- ten-year-old exposure is a very different risk to last month's.

  3. 03Linked Accounts & Associations

    Phone numbers, addresses and accounts that appear alongside it in the same records. This is what turns a single address into a picture of an attacker's infrastructure, or a victim's exposure.

  4. 04Security Assessment and Recommendations

    What the findings suggest doing. Advisory, and explicitly says so when no action is required.