- \n
- Improved Accuracy<\/strong> \u2013 By enriching an email address, the precision of the findings can be increased. The resulting information can be used to validate information found via other sources.<\/li>\n\n\n\n
- Deeper Insights<\/strong> \u2013 An Enriching email offers a lot of information that can uncover secrets about the individual or entity behind it. It includes their connections, interests, patterns, etc., which may not be visible from the email address alone.<\/li>\n\n\n\n
- Time Efficiency<\/strong> \u2013 Automated email enrichment can quickly gather data, saving valuable information for OSINT professionals.<\/li>\n<\/ul>\n\n\n\n
In below image, you can see the results of email enrichment(reverse lookup module) for our friend’s email –<\/p>\n\n\n\n
![\"Results](\"https:\/\/usersearch.org\/updates\/wp-content\/uploads\/2024\/08\/email-enrichment-result-1024x445.jpeg\")
Results of Email Enrichment on our friend’s email<\/figcaption><\/figure>\n\n\n\n Data Sources of Email Enrichment<\/h2>\n\n\n\n
Email enrichment relies on a variety of data sources, including :<\/p>\n\n\n\n
- \n
- Public Records<\/strong> – This consists of all publicly available government databases, public directories, and other official records posted by any reputed organization.<\/li>\n\n\n\n
- Social Media – <\/strong>This includes finding social media profiles associated with that email via manual or automated tools, such as accounts on Medium, LinkedIn, etc.<\/li>\n\n\n\n
- Proprietary Databases<\/strong> \u2013 This includes searching commercially available databases that provide much additional information that may not be directly accessible.<\/li>\n<\/ol>\n\n\n\n
Core Components of Email Enrichment<\/h2>\n\n\n\n
Common data points that we collect during email enrichment include \u2013<\/p>\n\n\n\n
- \n
- Name and Aliases<\/strong> \u2013 Identifying the real name and aliases of the individual or entity<\/li>\n\n\n\n
- Phone Number and Email<\/strong> \u2013 finding contact numbers and additional emails linked to that email<\/li>\n\n\n\n
- Social Profiles<\/strong> \u2013 Associated social media accounts and their online activity<\/li>\n\n\n\n
- Addresses<\/strong> \u2013 Physical addresses connected to that email<\/li>\n\n\n\n
- Job Details<\/strong> \u2013 Employment history, job titles, etc<\/li>\n\n\n\n
- Interests<\/strong> \u2013 Which streaming platform, gaming platform, etc is being used<\/li>\n<\/ul>\n\n\n\n
These are just generic data points; in the real world, you may find additional data points not listed above or maybe fewer data points listed above. How much data you can find about that email is dependent on the internet activity of that individual or entity. <\/strong><\/p>\n\n\n\n
For example, suppose we perform email enrichment on a corporate email of any company that has strict rules about the usage of email. In that case, you will rarely get information about that email as their internet usage will be limited to the official work of the company. But suppose we perform email enrichment on a student pursuing a technical degree. In that case, he will be actively using the internet to learn from different sources and explore different ones, so we will be getting a lot more information about them. In general, we can say that how much information we get will be limited by the internet usage of the individual.<\/p>\n\n\n\n
Tools and Techniques<\/h2>\n\n\n\n
As we all know, tools and techniques within the OSINT and cyber investigation fields need to grow and frequently adapt in order to keep that ‘investigative edge’. If a tool works fine today, it may not work the same tomorrow. While using tools saves a lot of time and effort, blindly depending on the use of a tool is a very bad idea. <\/p>\n\n\n\n
Apart from tools, there may be multiple techniques for extracting the same information in multiple ways, so always stay open to learning new tools and techniques.<\/p>\n\n\n\n
![\"OSINT](\"https:\/\/usersearch.org\/updates\/wp-content\/uploads\/2024\/08\/osint-tools-techniques-1024x585.webp\")
<\/figure>\n\n
“Never rely on just one tool during investigations. Verify, verify, verify. <\/p>\n\n\n\n
Most online tools rely on live data, or previosly crawled live data. Systems go down and cause false positives. AI and databases can get it wrong. Always have a second tool to verify results, and ideally have the skills to manually verify what the tools can do.”<\/p>\n\n\n\n
Lee Lewis, UserSearch Founder & Digital Forensic Expert.<\/p>\n<\/blockquote>\n<\/div><\/div>\n\n\n\n
While manual techniques involve directly searching and cross-referencing various data sources, this approach can be frustrating and time-consuming. Automated tools leverage APIs to gather and process data rapidly, but offering more efficient solutions costs additional power or money.<\/p>\n\n\n\n
Popular tools for email enrichment are as follows \u2013<\/strong><\/p>\n\n\n\n
- \n
- UserSearch <\/a>is a professional OSINT platform with a budget-friendly, easy-to-use interface where you can use most of the investigation tools, datasets, and techniques. It allows you to search for email addresses in breach data and global scam databases. It offers other cool features like reverse lookup, analyzing email addresses, domain ownership checks, and more. It\u2019s one of the best platforms for email enrichment.<\/li>\n\n\n\n
- OSINT Industries is an email OSINT tool that discovers linked accounts and compiles comprehensive, intel-rich digital profiles. Its API is fully integrated into UserSearch, providing all the search modules for reverse email and phone lookups that osint industries support.<\/li>\n\n\n\n
- Hunter.io specializes in bulk email verification, providing detailed information on email validity and associated domains.<\/li>\n<\/ol>\n\n\n\n
There are many other really good email enumeration tools; we just listed the popular ones that people love using the most. Our favorite is UserSearch<\/a> (of course!).<\/p>\n\n\n\n
How to enrich an email using UserSearch?<\/h2>\n\n\n\n
- \n
- Log in to UserSearch.ai with your username and password. If you’re a new user, click the signup button on the signing page to create an account.<\/li>\n\n\n\n
- Once logged in, go to the dashboard and select the email address in Search Type. <\/li>\n\n\n\n
- Now, select what enriched data you want to search for. (You can click on the question mark icon to understand the different options offered)<\/li>\n\n\n\n
- Here, we selected Reverse Lookup (slow, enriched); now, enter the email address and click on search.<\/li>\n\n\n\n
- You can see all the results in the search results tab, as shown in the below picture.<\/li>\n\n\n\n
- You can see detailed results by clicking on any search result in the search results tab.<\/li>\n<\/ol>\n\n\n\n
OSINT Industries Integration at UserSearch<\/h2>\n\n\n\n
We may have touched on this before, but it’s such a crucial point that it deserves its paragraph. OSINT Industries is a leading authority in email enrichment services. That’s why we have fully integrated their API into one of our key features. What does this mean for you? Every module supported by OSINT Industries is instantly available through UserSearch Premium. While the interface may differ, the information you can access is identical, thanks to our use of their API.<\/p>\n\n\n\n
We pay for this premium access and pass the benefits directly to our users. Due to our strong relationship with OSINT Industries and a bulk-buying agreement, we secure credits at a lower cost per unit. As a result, we can offer you email enrichment services at a price lower than what you’d pay directly to OSINT Industries. The savings might seem small initially, but they quickly add up if you’re conducting a high volume of searches!<\/p>\n\n\n\n
And don’t forget: We offer five additional email enrichment features alongside our integration with OSINT Industries, including Hudson Rock<\/a> integrations, HaveIBeenPwned<\/a>, ScamSearch<\/a>, plus features for email lookups built by our own experts.<\/p>\n\n\n\n
Email Enrichment for OSINT Investigations<\/h2>\n\n\n\n
Integrating enriched email data with other OSINT techniques creates more detailed target profiles. Investigators can use it to identify connections and networks and understand threat assessments.<\/p>\n\n\n\n
Some of the OSINT techniques that you could utilise as part of email enrichment are:<\/p>\n\n\n\n
- \n
- Searching email on Search Engines and Social Media:<\/strong> If you are investigating an email, you should also search that email on search engines and social media websites using Dorking techniques. Sometimes, you will get some information about them as you won’t be the first person encountering that email, so maybe someone has shared any information about that email earlier. For example, if the target email is target@evil.com, we shall search “target@evil.com” on Google along with the quotation.<\/li>\n\n\n\n
- Investigating the first part of the email individually<\/strong>: Most people use the same username everywhere, and in many cases, it’s probably the first of the email. So, perform username OSINT on the first part of the email; we may find some accounts associated with that email. This increased attack surface can help in gathering more data. For example, if the target email is target@evil.com, we shall perform username OSINT by taking the target as the username.<\/li>\n\n\n\n
- Trying email permutator: <\/strong> If the first part of the email looks unique, then permutate the first part of the email with other public email providers and see if any email exists and check if it belongs to your target or not. For example, if the target email is target@evil.com, we shall try to check if emails like target@gmail.com, target@email.com, exists or not.<\/li>\n<\/ul>\n\n\n\n
Email Enrichment use-cases<\/h3>\n\n\n\n
- \n
- Fraud Investigation<\/strong>
Assume Alex receives an email stating he has won a giftware voucher worth $10k. As he was well aware of cybercrime, he instantly understood that it was a fake email. Now, he performs email enrichment on the sender\u2019s email and learns some of the attacker’s personal information. He then reports it to authorities to investigate this, making their work easy by providing the attacker’s personal information. The authorities reacted quickly, and the attacker was arrested.<\/li>\n\n\n\n- Corporate Espionage<\/strong>
Assume Chris is a startup’s Chief Security Officer. He suspects an employee is leaking sensitive information. He performs email enrichment on employees’ emails using UserSearch and learns that his emails have accounts on some illegal forums. Now, as he has some leads, he can ask the IT team to check his work desktop to gather more evidence.<\/li>\n\n\n\n- Child Abuse<\/strong>
Assume Lucy volunteers at an NGO that works for children’s welfare. One day, they learned about a dark forum where the admin was selling a collection of child abuse content. The only accepted form of payment was crypto. Lucy contacted the admin as a customer and convinced (social-engineered) the admin to share his email so they could stay in contact if the forum went down for any reason. Now, she can perform email enrichment and other OSINT techniques to uncover the real identity behind this crime.<\/li>\n<\/ol>\n\n\n\nEmail enrichment can be helpful in many situations, depending on whether it is used for society’s betterment or personal or professional gains.<\/p>\n\n\n\n
Best Practices & Guidelines<\/h3>\n\n\n\n
Regional Laws<\/h2>\n\n\n\n
Each country has specific rules to determine the admissibility of evidence in criminal investigations. Whether the evidence is derived from OSINT investigations or something mundane, it must meet standards set by the country’s legal system.<\/p>\n\n\n\n
The fundamental criterion is to establish the facts ‘beyond reasonable doubt,’ ensuring the reliability of the presented evidence. However, the interpretation of ‘beyond reasonable doubt’ varies across different judicial systems. This variability can pose challenges for OSINT practitioners working with international clients. To navigate these complexities, it is advisable to adhere to a predefined, repeatable process, such as following a set of established guidelines. This approach typically satisfies the requirements of most legal frameworks by ensuring consistency and reliability in the results.<\/p>\n\n\n\n
International Guidelines<\/h2>\n\n\n\n
That being said, you must follow general best practices that are not globally enforced but are expected if you ever want a recipient to have confidence in your work. We’ve summarised the following, which are highlighted as essential points according to the UK ABI (Association for British Investigators), one of the oldest investigative bodies in the UK.<\/p>\n\n\n\n
Guidelines from ABI (Association of British Investigators<\/a>)<\/h3>\n\n\n\n
- \n
- Legal Compliance<\/strong>: Adherence to data protection laws such as the General Data Protection Regulation (GDPR) is crucial. This involves ensuring that personal data is collected and processed lawfully and transparently, respecting individuals’ privacy rights. Investigators must also respect intellectual property rights and terms of service of online platforms and avoid techniques that involve unauthorized access to computer systems\u200b.<\/li>\n\n\n\n
- Ethical Considerations<\/strong>: OSINT practitioners should prioritize respect for privacy, accuracy, and transparency. This means collecting only the necessary data, verifying the accuracy of the information, and being transparent about the methods and purposes of data collection. Ethical reviews should be conducted to assess potential risks and benefits before undertaking OSINT projects\u200b.<\/li>\n\n\n\n
- Research and Data Management<\/strong>: Developing a research plan that outlines objectives and steps for data collection, analysis, and preservation is essential. Conducting risk assessments to understand and mitigate potential risks to team members and data subjects is also important. Additionally, organizations should implement data protection policies and IT security measures to safeguard data and ensure compliance with legal standards\u200b.<\/li>\n\n\n\n
- Data Analysis and Verification<\/strong>: Ensuring that data analysis is objective, accurate, and allows for replicability is key. This includes acknowledging biases and limitations of the tools used and backing findings with multiple sources. Peer reviews and maintaining detailed technical documentation can help enhance the robustness and credibility of the analysis\u200b.<\/li>\n\n\n\n
- Use of Tools and Techniques<\/strong>: It is essential to keep up-to-date with new tools and techniques in OSINT. Investigators should use reliable tools and sources and stay informed about developments in the field to maintain effective methods for gathering and analyzing information.<\/li>\n\n\n\n
- Security Measures<\/strong>: Protecting the security of researchers and the data collected is vital. This may involve using secure communication channels, encrypting data, and taking precautions to avoid exposing sensitive information. To protect individuals ‘ privacy, measures such as pseudonymization and anonymization should be considered.<\/li>\n<\/ol>\n\n\n\n
Challenges and Limitations<\/h3>\n\n\n\n
- Ethical Considerations<\/strong>: OSINT practitioners should prioritize respect for privacy, accuracy, and transparency. This means collecting only the necessary data, verifying the accuracy of the information, and being transparent about the methods and purposes of data collection. Ethical reviews should be conducted to assess potential risks and benefits before undertaking OSINT projects\u200b.<\/li>\n\n\n\n
- Corporate Espionage<\/strong>
- Investigating the first part of the email individually<\/strong>: Most people use the same username everywhere, and in many cases, it’s probably the first of the email. So, perform username OSINT on the first part of the email; we may find some accounts associated with that email. This increased attack surface can help in gathering more data. For example, if the target email is target@evil.com, we shall perform username OSINT by taking the target as the username.<\/li>\n\n\n\n
- Searching email on Search Engines and Social Media:<\/strong> If you are investigating an email, you should also search that email on search engines and social media websites using Dorking techniques. Sometimes, you will get some information about them as you won’t be the first person encountering that email, so maybe someone has shared any information about that email earlier. For example, if the target email is target@evil.com, we shall search “target@evil.com” on Google along with the quotation.<\/li>\n\n\n\n
- Phone Number and Email<\/strong> \u2013 finding contact numbers and additional emails linked to that email<\/li>\n\n\n\n
- Social Media – <\/strong>This includes finding social media profiles associated with that email via manual or automated tools, such as accounts on Medium, LinkedIn, etc.<\/li>\n\n\n\n
- Deeper Insights<\/strong> \u2013 An Enriching email offers a lot of information that can uncover secrets about the individual or entity behind it. It includes their connections, interests, patterns, etc., which may not be visible from the email address alone.<\/li>\n\n\n\n