Overview#
An email address is often the single identifier that ties a person's online existence together. For fraud analysts at e-commerce platforms, KYC teams at banks, and investigators working identity theft cases, knowing whether an address is deliverable, whether it has appeared in a breach, and which online accounts it anchors can make the difference between approving a legitimate customer and onboarding a fraudster. Email Intelligence gives those teams the depth they need, going well beyond syntax validation to assess deliverability, exposure history, domain security posture, and linked digital identity.
Multi-layer validation and cross-referencing with breach databases enable investigators and security teams to assess email-based risk, verify identities, and detect fraudulent accounts before damage is done.
Key Features#
- Email Validation and Deliverability: Multi-layer validation including syntax checking, DNS verification, real-time SMTP mailbox existence confirmation, catch-all domain detection, disposable email provider identification, and spam trap detection
- Breach Exposure Detection: Check email addresses against credential breach databases to identify compromised accounts, exposed passwords, and historical breach involvement
- Domain Intelligence: Analyse email domain infrastructure including MX records, SPF/DKIM/DMARC authentication, hosting provider, and domain reputation for risk assessment
- Digital Identity Resolution: Discover online accounts, social media profiles, and digital identities associated with email addresses through cross-platform correlation
- Disposable Email Detection: Identify temporary and throwaway email addresses from 50,000+ tracked disposable email providers to flag potentially fraudulent registrations
- Email Pattern Analysis: Detect email address patterns, naming conventions, and format variations to identify related accounts and organisational email structures
- Risk Scoring: Composite risk assessment based on deliverability, breach history, domain reputation, disposable status, and associated digital footprint
- Bulk Processing: Validate and analyse large email lists for data hygiene, breach screening, and risk assessment with automated enrichment
Use Cases#
- Fraud Prevention: Screen email addresses during account registration to identify disposable emails, known breach victims, and suspicious patterns indicating fraudulent intent
- Identity Verification: Validate email addresses as part of KYC and background investigation processes, confirming deliverability and checking for compromise indicators
- Breach Response: Assess organisational email exposure across credential breaches, prioritize compromised accounts for remediation, and monitor for new exposures
- Investigation Support: Discover online accounts and digital identities linked to email addresses of interest, building comprehensive profiles for investigative analysis
- Email Security Assessment: Evaluate domain email authentication configurations to identify spoofing vulnerabilities and recommend security improvements
Integration#
The platform integrates with the broader Argus OSINT ecosystem for cross-domain intelligence correlation, identity verification workflows, breach intelligence monitoring, and investigation management. Supports both individual lookups and bulk processing for enterprise security operations. Email-based findings feed into person intelligence profiles and connect to social media discovery for comprehensive digital footprint analysis. Works with Cortex (TheHive) for analyst-driven enrichment and exports indicators to MISP for threat community sharing.
Open Standards#
- RFC 5321 (SMTP): The platform performs live SMTP dialogue to confirm mailbox existence, catch-all domain detection, and spam-trap identification during multi-layer email validation.
- RFC 5322 (Internet Message Format): Syntax validation of email addresses follows the address specification defined in RFC 5322, covering local-part and domain structure rules.
- RFC 7208 / RFC 6376 / RFC 7489 (SPF, DKIM, DMARC): Domain intelligence analysis queries and evaluates Sender Policy Framework, DomainKeys Identified Mail, and DMARC policies to assess spoofing risk and domain email authentication posture.
- DNS (RFC 1034 / RFC 1035): MX record resolution and broader DNS enumeration underpin deliverability checks, domain reputation assessment, and historical infrastructure correlation via SecurityTrails integration.
- OASIS STIX 2.1 / TAXII 2.1: Email-address indicators and breach findings are represented as STIX 2.1 objects and can be collected or distributed over TAXII 2.1 feeds, enabling interoperation with threat-sharing communities.
- MISP Core Format 2.4: Enriched email indicators and breach attributions are exported to MISP for community threat sharing, consuming the MISP event and attribute schema for cross-platform correlation.
- Traffic Light Protocol (TLP): All email intelligence profiles carry a TLP classification (White through Red) that governs sharing permissions, aligning with the FIRST TLP standard used across analyst workflows.
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14