Free email OSINT tool, 2500+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess
███╗ ███╗ █████╗ ██╗██╗ █████╗ ██████╗ ██████╗███████╗███████╗███████╗ ████╗ ████║██╔══██╗██║██║ ██╔══██╗██╔════╝██╔════╝██╔════╝██╔════╝██╔════╝ ██╔████╔██║███████║██║██║ ███████║██║ ██║ █████╗ ███████╗███████╗ ██║╚██╔╝██║██╔══██║██║██║ ██╔══██║██║ ██║ ██╔══╝ ╚════██║╚════██║ ██║ ╚═╝ ██║██║ ██║██║███████╗██║ ██║╚██████╗╚██████╗███████╗███████║███████║ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝╚══════╝╚═╝ ╚═╝ ╚═════╝ ╚═════╝╚══════╝╚══════╝╚══════╝
Self-hostable OSINT platform for investigating email addresses. Fan out across breach databases, social networks, DNS records, and the open web — get back a unified exposure score and structured findings you can export or pipe into Maltego.
Built for security researchers, OSINT analysts, and penetration testers operating under authorization. Read DISCLAIMER.md before use.
pip install mailaccess
mailaccess investigate [email protected]
Full install options (Docker, persistent server, self-hosting) -> docs/self-hosting.md.
mailaccess investigate [email protected]
mailaccess investigate [email protected] -o report.pdf
mailaccess harvest-emails --domain company.com
mailaccess harvest-emails --domain company.com --export harvest.csv
mailaccess keys set HIBP_API_KEY your-key
mailaccess keys list
mailaccess serve
mailaccess modules
Pipeline, stdin, JSONL, and CI examples -> docs/integrations.md.
harvest-emails discovers organization addresses across Common Crawl, GitHub, CT logs, registries, keyservers, dorks, employee pages, and patterns.Every investigation builds an identity graph linking accounts by shared usernames, photos, display names, and breach data. View it at /investigation/:id/graph, export it with GET /api/report/{id}/graph, or read the full model in docs/modules.md.
MailAccess collects name signals from profile modules and returns a defensible identity summary:
CONFIRMED IDENTITY
Name: Katriel Moses [CONFIRMED]
Sources: GitHub . Gravatar . Keybase . PGP
Reasoning: 4 independent sources agree.
Full confidence rules and source behavior -> docs/modules.md.
Every investigation includes a 30-second risk summary designed for security managers:
DEFENDER'S BRIEF
Risk: CRITICAL
Summary: Active infostealer infection detected.
1. Active credential theft [CRITICAL]
-> Rotate credentials immediately.
Next action: Immediately rotate credentials and enforce hardware MFA.
Suppress it with --no-brief; full details live in docs/modules.md.
64 modules, 2500+ platforms by default. Full module reference -> docs/modules.md.
Most modules work with zero keys. Optional keys unlock more coverage. Full list -> docs/api-keys.md.
Save reports as JSON, CSV, PDF, Markdown, STIX 2.1, or Maltego XML with -o. Full export reference -> docs/exports.md.
Use Maltego, Slack, Discord, generic webhooks, JSONL pipelines, and CI workflows. Full integration guide -> docs/integrations.md.
Run the CLI locally or launch the full web stack with Docker Compose. Full guide -> docs/self-hosting.md.
See CHANGELOG.md for release history.
MIT. All data queried by MailAccess comes from public sources. See DISCLAIMER.md for authorized use cases and legal responsibility.
| Self-hosting guide | Docker Compose, .env reference, PostgreSQL, proxy/Tor, Maltego setup |
| Module reference | All modules, findings schema, adding new modules |
| False-positive controls | Common-name, disposable-domain, clustering, health, and scoring controls |
| API reference | REST endpoints, WebSocket events, authentication |
| Export formats | Supported formats, MIME types, filename conventions |
| Integrations | Maltego, Slack, Discord, generic webhooks |
| Contributing | Adding modules, adding exporters, code style, PR checklist |
| PyPI | pip install mailaccess |
| GitHub | Source code, issues, releases |