> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/passive-reconnaissance-techniques/email-footprinting.md).

# Email Footprinting

Email footprinting is gathering information about email addresses to uncover associated data, potential security risks, and relationships with various online services.

### **Importance of Email Footprinting**

Email footprinting helps in:

* Identifying linked accounts and online services.
* Discovering data breaches involving the email address.
* Tracking an individual’s digital footprint.
* Conducting phishing awareness assessments.

## **Techniques for Email Footprinting**

### **Data Breach Analysis**

* [**Have I Been Pwned**](https://haveibeenpwned.com/) – Checks if an email is part of known data breaches.
* [**Dehashed**](https://dehashed.com/) – Searches for leaked credentials and associated data.
* [**IntelX**](https://intelx.io/) – Looks for emails in past leaks and dark web repositories.

### **Social Media & Account Association**

* [**GHunt**](https://github.com/mxrch/GHunt?tab=readme-ov-file) – Investigates Google accounts linked to an email.
* [**WhatsMyName**](https://whatsmyname.app/) – Checks if an email is registered on social platforms.

### **Email Header Analysis**

Email headers contain crucial information that can help determine whether an email is legitimate or malicious. Key email header details include:

* Sender's name
* IP/Email address of the sender
* Mail server details
* Mail server authentication system
* Send and delivery timestamps
* Unique message identifier

**Tools for Email Header Analysis**

* [**MXToolbox**](https://mxtoolbox.com/) – Analyzes email headers and traces origins.
* **Email Header Analyzer (Google)** – Extracts metadata from email headers.
* [**IPinfo.io**](https://ipinfo.io/) – Identifies geolocation from the email sender’s IP.

#### **Authentication Methods**

* **SPF (Sender Policy Framework)** – Verifies if the IP address of the email sender is authorized to send emails for a given domain.
* **DKIM (DomainKeys Identified Mail)** – Ensures the authenticity of an email through digital signatures.
* **BIMI (Brand Indicators for Message Identification)** – Displays brand logos in recipients' inboxes to improve trust and combat phishing attacks.
* **DMARC (Domain-based Message Authentication, Reporting, and Conformance)** – Combines SPF and DKIM to provide a comprehensive email authentication framework.

**Email Authentication Tools**

* [**MXToolbox**](https://mxtoolbox.com/)
* [**DMARC Analyzer**](https://www.dmarcanalyzer.com/)
* [**EasyDMARC**](https://easydmarc.com/)
* [**Dmarcian**](https://dmarcian.com/)
* [**Valimail**](https://domain-checker.valimail.com/dmarc)

### **OSINT Search**

* [**Google Dorking**](/infosec-notes/reconnaissance/passive-reconnaissance-techniques/google-dorking.md) – Uses advanced queries to search for email leaks.
* [**Pastebin**](https://pastebin.com/) – Finds emails in paste sites and data dumps.
* [**Sherlock**](https://github.com/sherlock-project/sherlock) – Looks up associated social media profiles.

### **Email Tracking**

Email tracking monitors email delivery, open rates, and recipient actions, such as link clicks and attachment downloads. This typically involves embedding a tracking pixel in the email content.

**Email Tracking Tools**

* [**GetNotify**](https://www.getnotify.com/)
* [**ReadNotify**](https://www.readnotify.com/)
* [**Mailtrack**](https://mailtrack.io/en/)
* [**Outreach**](https://www.outreach.io/)
* [**Cirrus Insight**](https://www.cirrusinsight.com/email-tracking)
* [**Yesware**](https://www.yesware.com/feature/email-tracking)

### **Email Spoofing**

Email spoofing is the practice of forging an email header to make it appear as if the email was sent from a different sender. Attackers use this technique for phishing, social engineering, and malware distribution.

**Preventing Email Spoofing**

Implementing SPF, DKIM, BIMI, and DMARC can help verify email authenticity and mitigate spoofing attacks.

**Email Spoofing Tools**

* [**Emkei**](https://emkei.cz/)
* [**Anonymailer**](https://www.anonymailer.net/)
* [**Spoofbox**](https://www.spoofbox.com/en/preview/spoof-email)
* [**Send Anonymous Email**](http://www.sendanonymousemail.net/)

### Reference

{% embed url="<https://github.com/InfoSecWarrior/Offensive-Recon/blob/main/Email.md>" %}

{% embed url="<https://github.com/undergroundwires/CEH-in-bullet-points/blob/master/chapters/02-footprinting/email-footprinting.md>" %}