loading
Loading content
loading
OSINT
Email OSINT from public sources, with optional breach checks.
overview
Infoga mines public sources for email addresses tied to a domain: search engines and PGP key servers. It can attach IP, hostname, and country, then mark addresses found in Have I Been Pwned.
Set -d for the domain, -s for a source (google, bing, pgp, or all), -i for enrichment, and -b for breach lookups. -v controls how much the run prints.
Use it in early recon when you need a domain email footprint without touching mail servers. Trickest hosts Infoga as a managed OSINT node that writes FILE and FOLDER for the next stage. theHarvester casts a wider net; h8mail digs deeper on leaks.
use cases
Mine search engines, PGP servers, and Shodan for the addresses a domain leaks in public, and build a picture of who is reachable before an engagement.
Turn on breach mode to cross-check each discovered address against Have I Been Pwned and mark the ones already sitting in known leaks.
Point -s at one engine, such as google, bing, or pgp, to control where address harvesting pulls from and keep a run focused.
Use info mode to attach the source IP, hostname, and country to each address before it feeds a report or the next recon node.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Target domain or name to gather email intelligence for. |
| source-data | STRING | -s | Search source to use: google, bing, yahoo, ask, baidu, dogpile, exalead, or pgp (default all). |
| info | BOOLEAN | -i | Get email information for the discovered addresses. |
| breach | BOOLEAN | -b | Check whether each email appears in known breaches. |
| verbose | STRING | -v | Verbosity level (1, 2, or 3). |
Showing key inputs. Infoga exposes 5 inputs in total.
example
# harvest a domain's emails across all sources and flag breached accountsinfoga -d example.com -s all -b -v 2[*] Searching emails for example.com across all sources[+] Emails found (3): admin@example.com careers@example.com m.owens@example.com[+] admin@example.com ip 203.0.113.45 host mail.example.com country United States[!] admin@example.com breached: found in 3 known leaks[-] careers@example.com no breach records foundguidance
Use Infoga to harvest a domain email footprint from public OSINT and flag breached addresses. For deeper leak hunting by email, prefer h8mail. For broader emails-plus-hosts OSINT, theHarvester covers more source types.
Harvests emails, subdomains, and hosts from many public sources. Broader OSINT; no built-in breach check.
Breach and leak hunting by email. Deeper compromise data than Infoga HIBP checks.
Checks where an email is registered across sites. Account discovery, not breach corpora.
faq
related
Passive DNS records from DNSDumpster.
Generate lookalike domains and flag registered typosquats.
Look up the real IP of a host from its favicon via Shodan.
Check whether emails and usernames are available, taken, or invalid.
Passive DNSDumpster host lookup by domain.
List public repositories for each GitHub username you already have.
A domain feeds Infoga, which harvests email addresses from public sources, flags the breached ones, and writes them as a queryable output.
Facts on this page come from the live Trickest tool library.