Guide · Updated · By William Lodge
How to Investigate a Suspicious Email Address
Check whether an email address is risky or part of a phishing attempt: reputation lookups, breach exposure, header analysis, and domain checks.
An unexpected invoice, a "security alert," or a message from a new business contact — before you click or reply, a few minutes of open-source checks can tell you a lot about the sender. This guide covers checks you can run on email addresses you've received messages from, or that belong to you or your organization.
1. Check the address's reputation
EmailRep returns reputation signals for an address: how long it has been seen online, whether it appears in breaches, whether it's linked to profiles, and whether it's been flagged for malicious activity. A brand-new address with no history sending you an urgent payment request is a red flag.
2. Look at the domain, not just the name
Display names are trivial to fake. Look at the actual address and its domain:
- Lookalike domains —
rnicrosoft.com,paypa1.com, or extra words likecompany-billing.com. - Domain age — a domain registered last week is a common phishing pattern. WHOIS and Web-Check show registration and DNS details.
- Mail records — does the domain have MX, SPF, and DMARC records? Legitimate businesses almost always do.
- Certificates — crt.sh can show when the domain first got a certificate and what related hostnames exist.
3. Read the email headers
Every email client can show the original message with full headers ("Show original" in Gmail, "View message source" in Outlook). Look for:
- Authentication results —
spf=pass,dkim=pass,dmarc=pass. Failures on a message claiming to be from a major brand strongly suggest spoofing. - Return-Path and Reply-To — replies going to a different domain than the sender is a classic phishing trick.
- Received lines — the servers the message passed through. Check sending IPs on AbuseIPDB.
4. Check breach exposure
For addresses you own or are responsible for, breach-checking services such as Have I Been Pwned show which known breaches included the address. Command-line tools like H8mail can search breach sources you have access to. Exposure means the address (and possibly an old password) is in criminal hands — a reason to change passwords and enable multi-factor authentication. Never use exposed credentials to log in to anything.
5. Check links without clicking
Hover to see the real destination. Paste suspicious URLs into a reputation or sandbox service rather than opening them, and review the destination domain the same way as the sender's domain.
Report it
If it's phishing, report it through your email provider and your organization's security team. Share the full headers — they're what investigators need.
More tools: Email & exposure and Threat intelligence.
You are responsible for authorization and the laws that apply to your research. OSINTCompass lists tools for lawful, ethical public-source research.