Email-to-Identity Resolution

Overview

Email-to-identity resolution takes a verified address and attributes it to a real person. The two primary methods are breach correlation, which finds what the address has been exposed in and what other data is attached to it, and email header analysis, which traces the origin of a received message through its routing metadata.

Breach and Leak Correlation

When an email address appears in a data breach, the breach record often contains additional fields: usernames, hashed or plaintext passwords, phone numbers, physical addresses, dates of birth, and IP addresses. These fields provide direct attribution and feed into other intelligence workflows.

Have I Been Pwned

HIBP is the most comprehensive public breach index. It confirms which breaches an address appears in without returning the breach data itself:

Each breach name returned tells you what data classes were exposed. LinkedIn breaches often contain real names and job titles. Adobe contains usernames and password hints. Knowing which breaches contain the address tells you where to look for richer data in full breach datasets.

IntelX and Dehashed

Intelligence X and Dehashed index full breach records and allow searching by email address, returning associated usernames, passwords, and other fields from the original breach data. Both require paid access for full results.

IntelX API search:

Passwords found in breach data, even hashed ones, are useful for attribution. A reused password hash that appears in multiple breaches under the same email address confirms account ownership. A cracked password that matches a username or real name is a strong attribution signal and may reveal additional accounts through username enumeration.

Reverse Email Search Across Platforms

Many platforms allow account lookup or password reset by email address, which confirms whether an account exists at that platform without requiring credentials. This is a passive signal rather than full access.

Test whether an email is registered on a platform by attempting a password reset and observing whether the platform confirms or denies the address:

• A response of we have sent a reset link confirms the address is registered

• A response of no account found confirms it is not

• Some platforms return the same response regardless to prevent enumeration

This technique should be used selectively. Password reset attempts are logged and may trigger security alerts on the account.

Email Header Analysis

When you have received a message from a subject or have access to a forwarded email, the headers contain routing metadata that can reveal the sender's real IP address, mail client, and sending infrastructure.

Extract headers from a raw email file:

The X-Originating-IP header, when present, is the sender's real IP address at the time of sending. This is the most valuable field for geolocation and infrastructure attribution. Not all mail clients or providers include this header. Gmail strips it. Outlook and some webmail clients include it.

The Received chain shows every mail server the message passed through in reverse order. The bottom-most Received header is the first hop and closest to the sender. Work upward through the chain to trace the routing path.

Parse headers automatically with MXToolbox or Google's header analyser for a visual routing trace:

Message-ID Attribution

The Message-ID header is generated by the sending mail client or server and sometimes contains the sender's hostname or domain. A Message-ID of the form abc123@@laptop.internal.example.com reveals the internal hostname of the sender's machine, which can confirm employment at an organisation even when the From address uses a personal domain.

What to Do With Results

Any IP address extracted from headers feeds into geolocation and infrastructure lookups. A confirmed real name from breach data feeds into variation generation and further username enumeration. A username from breach data runs directly through Sherlock.