Skill: osint-identity-researcher
Time: ~20 minutes

Goal

Determine whether an email appears in public breaches or public directories — for security or corroboration, not doxxing.

Steps

1. Confirm you have lawful authority to query (your org’s email, or public campaign contact).
2. Use reputable breach-status tools that do not exfiltrate the address to untrusted parties (follow org policy).
3. Record which breach and year only; do not reuse passwords.
4. If address is historic, note that it may no longer be valid.
5. Never publish full breach dumps or paste credentials.
6. For private individuals, default to not searching.

Pitfalls

• Typo squat addresses.
• Shared inboxes at campaigns.

Next steps

• Tutorial — Breach data analysis (defensive framing)