OSINT
Map domain emails and breached accounts from public sources
Email OSINT from public sources, with optional breach checks.
overview
What Infoga does
Infoga mines public sources for email addresses tied to a domain: search engines and PGP key servers. It can attach IP, hostname, and country, then mark addresses found in Have I Been Pwned.
Set -d for the domain, -s for a source (google, bing, pgp, or all), -i for enrichment, and -b for breach lookups. -v controls how much the run prints.
Use it in early recon when you need a domain email footprint without touching mail servers. Trickest hosts Infoga as a managed OSINT node that writes FILE and FOLDER for the next stage. theHarvester casts a wider net; h8mail digs deeper on leaks.
use cases
Where Infoga fits
Map a domain's email exposure
Mine search engines, PGP servers, and Shodan for the addresses a domain leaks in public, and build a picture of who is reachable before an engagement.
Flag breached accounts
Turn on breach mode to cross-check each discovered address against Have I Been Pwned and mark the ones already sitting in known leaks.
Target a single OSINT source
Point -s at one engine, such as google, bing, or pgp, to control where address harvesting pulls from and keep a run focused.
Enrich addresses with context
Use info mode to attach the source IP, hostname, and country to each address before it feeds a report or the next recon node.
reference
Infoga inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Target domain or name to gather email intelligence for. |
| source-data | STRING | -s | Search source to use: google, bing, yahoo, ask, baidu, dogpile, exalead, or pgp (default all). |
| info | BOOLEAN | -i | Get email information for the discovered addresses. |
| breach | BOOLEAN | -b | Check whether each email appears in known breaches. |
| verbose | STRING | -v | Verbosity level (1, 2, or 3). |
Showing key inputs. Infoga exposes 5 inputs in total.
example
Run Infoga
# harvest a domain's emails across all sources and flag breached accountsinfoga -d example.com -s all -b -v 2[*] Searching emails for example.com across all sources[+] Emails found (3): admin@example.com careers@example.com m.owens@example.com[+] admin@example.com ip 203.0.113.45 host mail.example.com country United States[!] admin@example.com breached: found in 3 known leaks[-] careers@example.com no breach records foundguidance
Choosing Infoga
Use Infoga to harvest a domain email footprint from public OSINT and flag breached addresses. For deeper leak hunting by email, prefer h8mail. For broader emails-plus-hosts OSINT, theHarvester covers more source types.
theHarvester
Harvests emails, subdomains, and hosts from many public sources. Broader OSINT; no built-in breach check.
h8mail
Breach and leak hunting by email. Deeper compromise data than Infoga HIBP checks.
holehe
Checks where an email is registered across sites. Account discovery, not breach corpora.
faq
Infoga questions
related
More OSINT tools
dnsdumpster-dns-lookup
Passive DNS records from DNSDumpster.
dnstwist
Generate lookalike domains and flag registered typosquats.
favup
Look up the real IP of a host from its favicon via Shodan.
maigret
Username search that collects accounts and profile data into one dossier.
socialscan
Check whether emails and usernames are available, taken, or invalid.
dnsdumpster-host-search
Passive DNSDumpster host lookup by domain.
Run Infoga yourself
A domain feeds Infoga, which harvests email addresses from public sources, flags the breached ones, and writes them as a queryable output.
Facts on this page come from the live Trickest tool library.