# Investigating an Email With OSINT Tools

> Published  Jun 06 2025, last updated Jun 06 2025  
> By Ryan Fleck <hello@this-site> and written without LLMs!  
> Original post at <https://ryanfleck.ca/chat-gpt/2025/investigating-an-email-with-osint-tools/>  
> An article of astonishing quality and insight. Happy Hacking!


In conversation with DeepSeek R1:

> If I have an email of someone who is blackmailing me, how can I find
> out more about this person with open source intelligence?

If you're being blacklisted, your safety is the top priority. **Do not
engage with the blackmailer directly**, as this could escalate the
situation. Instead, consider the following **open-source intelligence
(OSINT)** steps to gather information while protecting yourself:

### **1. Preserve Evidence**
- Save all emails, messages, and any communication (take screenshots if needed).
- Check email headers for metadata (see below).

### **2. Analyze the Email Headers**
Email headers contain routing information that can reveal the sender's IP address or location.
- **Gmail**: Open the email → Click the three dots (⋮) → "Show original" → Copy the full headers.
- **Outlook/Others**: Open the email → View → "View message source" or similar.
- Use tools like:
  - [**MxToolbox Email Header Analyzer**](https://mxtoolbox.com/EmailHeaders.aspx)
  - [**Google Admin Toolbox Messageheader**](https://toolbox.googleapps.com/apps/messageheader/)
  - Look for **IP addresses** and trace them using [**IPinfo.io**](https://ipinfo.io/) or [**AbuseIPDB**](https://www.abuseipdb.com/).

### **3. Check for Reused Usernames/Emails**
Search the email or username across platforms:
- **Google/DuckDuckGo**: `"email@example.com"` (in quotes for exact matches).
- **Username search engines**:
  - [**WhatsMyName**](https://whatsmyname.app/)
  - [**Namechk**](https://namechk.com/)
  - [**Sherlock**](https://github.com/sherlock-project/sherlock) (GitHub tool for username checks).

### **4. Reverse Image Search (If They Sent Photos)**
If the blackmailer sent images, use:
- [**Google Reverse Image Search**](https://images.google.com/)
- [**TinEye**](https://www.tineye.com/)
- [**Yandex Images**](https://yandex.com/images/)

### **5. Check Phone Numbers (If Provided)**
- Use [**Truecaller**](https://www.truecaller.com/) or [**SpyDialer**](https://www.spydialer.com/).
- Search on [**NumLookup**](https://www.numlookup.com/).

### **6. Look for Data Breaches**
- Check if the email appears in leaks: [**Have I Been Pwned**](https://haveibeenpwned.com/).
- Search [**Dehashed**](https://www.dehashed.com/) (paid but powerful).

### **7. Report & Seek Help**
- **Law Enforcement**: Contact your local police or cybercrime unit (e.g., **FBI IC3** if in the U.S.).
- **Platforms**: Report the account to the email provider (Gmail, Outlook, etc.).
- **Support Organizations**: Reach out to **Cyber Civil Rights Initiative (CCRI)** if it involves intimate images.

### **⚠️ Important Warnings**
- **Do NOT pay** the blackmailer—it rarely stops the demands.
- **Do NOT interact** with them further.
- **Secure your accounts** (enable 2FA, change passwords).
- If physical threats are involved, **contact law enforcement immediately**.


Since the blackmailer is using a **Gmail account**, your options for tracing them via open-source intelligence (OSINT) are more limited—but not impossible. Here’s how you can investigate further while staying safe:


### **1. Extract & Analyze Email Headers (Key First Step)**
Gmail headers may contain the sender’s **IP address** if they accessed Gmail via a web browser (less likely if they used the Gmail app).
**How to get headers:**
- Open the email in Gmail → Click the **three dots (⋮)** → **"Show original"**.
- Copy the full text (headers + body) and paste into:
  - [**MxToolbox Email Header Analyzer**](https://mxtoolbox.com/EmailHeaders.aspx)
  - [**Google Admin Toolbox Messageheader**](https://toolbox.googleapps.com/apps/messageheader/)

**Look for:**
- `Received: from` lines (may show an IP near the top if the sender didn’t use Gmail’s app).
- If you find an IP, check it on [**IPinfo.io**](https://ipinfo.io/) or [**AbuseIPDB**](https://www.abuseipdb.com/).

⚠️ **Note:** If the sender used the Gmail app or was always logged in, the IP will likely just point to Google’s servers (e.g., `google.com`).



### **2. Search the Gmail Address Across the Web**
Even if the account was created just for blackmail, the attacker might have reused it elsewhere.
- **Google Search**: `"username@gmail.com"` (include quotes for exact matches).
- **Username Search**: If the email is something like `john.doe@gmail.com`, search `john.doe` on:
  - [**WhatsMyName**](https://whatsmyname.app/)
  - [**Sherlock**](https://github.com/sherlock-project/sherlock) (GitHub tool for username checks).



### **3. Check for Data Breaches (Was This Email Leaked Before?)**
- [**Have I Been Pwned**](https://haveibeenpwned.com/) (free).
- [**Dehashed**](https://www.dehashed.com/) (paid, but more detailed).
If the email appears in leaks, you might find:
  - Passwords (don’t reuse them!).
  - Linked accounts (social media, forums).



### **4. Reverse Image Search (If They Sent Photos)**
If the blackmail includes images:
- [**Google Images**](https://images.google.com/) (upload the image).
- [**TinEye**](https://www.tineye.com/).
- [**Yandex Images**](https://yandex.com/images/) (sometimes better than Google).



### **5. Check for Linked Accounts (If They Slipped Up)**
- **Google "Password Reset" Trick**:
  - Go to Gmail’s login page → Click "Forgot password?" → Enter their email.
  - If Google shows a **partial recovery phone/email** (e.g., `***@protonmail.com`), this could hint at another account.
  - ⚠️ **Do NOT attempt to reset their password** (illegal). This is just for info.



### **6. Report to Google & Law Enforcement**
- **Report to Google**:
  - Forward the email to **abuse@gmail.com** (include full headers).
  - Use Google’s [**Report Blackmail Form**](https://support.google.com/mail/contact/abuse).
- **Law Enforcement**:
  - File a report with **local police** and/or **FBI IC3** (if in the U.S.): [https://www.ic3.gov](https://www.ic3.gov).
  - If the blackmail involves explicit content, contact **Cyber Civil Rights Initiative (CCRI)**: [https://www.cybercivilrights.org](https://www.cybercivilrights.org).



### **⚠️ Critical Reminders**
- **Do NOT pay**—it makes the blackmail worse.
- **Do NOT engage**—any response encourages them.
- **Secure your accounts** (change passwords, enable 2FA).

If you’d like, I can guide you through analyzing the email headers—just redact personal info first. Stay safe!

# Additional Suggestions from ChatGPT

> Do you have anything to add to the instructions [above]?

Your guide is thorough, actionable, and sensitive to the user's safety—excellent work. Here are a few **additional suggestions and refinements** to consider adding for completeness and clarity:



## ✅ **Suggestions to Add or Emphasize**

### **0. Secure Your Device and Network First**

Before performing OSINT or handling any suspicious content:

* Run a **full antivirus scan**.
* Check for signs of **remote access software** (e.g., TeamViewer, AnyDesk).
* Use a **VPN** when researching the blackmailer to obscure your own IP.



### **1. Use a Dedicated Environment**

To avoid accidental exposure:

* Use a **separate browser profile** (or incognito window) for investigation.
* Preferably, use a **non-primary device** (e.g., a clean VM or old laptop).



### **2. Cross-reference the Email Domain (If Not Gmail)**

If the blackmailer uses a custom domain (e.g., `@suspicious-domain.com`):

* Run a **WHOIS lookup** ([whois.domaintools.com](https://whois.domaintools.com), [https://who.is](https://who.is)) to check:

  * Creation date
  * Registrar
  * Contact email (sometimes visible)
* Check **DNS records** using [SecurityTrails](https://securitytrails.com) or [ViewDNS.info](https://viewdns.info/).
* Use [**urlscan.io**](https://urlscan.io/) to analyze any links they send.



### **3. Analyze Writing Style (Optional but Advanced)**

Use **stylometry** to compare the attacker’s writing:

* Tools like [JStylo](https://psal.cs.drexel.edu/index.php/JStylo-Anonymouth) or [Writeprints](https://www.cs.ucf.edu/~weli/Writeprints.html) can help.
* This is speculative but useful if you have other suspect emails.



### **4. Set Up Monitoring Alerts**

If the attacker reuses aliases or emails later:

* Use [Google Alerts](https://www.google.com/alerts) with their email/username.
* Use [Have I Been Pwned](https://haveibeenpwned.com/NotifyMe) to **monitor leaks** with your own email.



### **5. Explore Paste Sites and Forums**

Search dark web-adjacent paste sites (some might list extortion attempts or email dumps):

* [Pastebin](https://pastebin.com/) (use search engines like [Pastebin Search](https://controlc.com/search.php))
* [Scylla.sh](https://scylla.sh/)
* [IntelX](https://intelx.io/) (limited free queries)



### **6. Document Your Actions**

Keep a **timeline and log** of everything you do, including:

* Dates of emails
* Sites/tools used
* Any reports filed

This is helpful for police or legal escalation.



## 🧹 **Minor Refinements**

* **Repetitive header advice**: You mention analyzing headers in both steps 2 and again later. You could consolidate them.
* **Legal boundary reminder**: When mentioning the Gmail password reset trick, you already note not to proceed—but consider emphasizing that any unauthorized access attempt may violate laws like the **Computer Fraud and Abuse Act (CFAA)**.
* **Tone consistency**: At the start, you say “If you’re being blacklisted,” but the context is blackmail. “Blacklisted” might confuse the reader—consider replacing with “blackmailed.”



> Thank you for reading!  
> Find more content at <https://ryanfleck.ca/>  
> Source page: <https://ryanfleck.ca/chat-gpt/2025/investigating-an-email-with-osint-tools/>  
> Site index: [llms.txt](https://ryanfleck.ca/llms.txt)