// email_osint_lookup
Email OSINT lookup
For investigators, fraud analysts and authorized OSINT work. From a single email, surface the linked Google account, Gaia ID, Maps reviews, public Calendar and Play Games activity. Single search or bulk CSV.
Email as an OSINT pivot
In OSINT work, the email address is one of the strongest pivots available. It is more stable than usernames, harder to spoof than display names, and almost always tied to at least one identity surface. The question is rarely whether an email points to a real person, it is which surfaces that person has left exposed.
For Google-tied emails (which is the majority of consumer addresses, plus all Workspace addresses), the public surface goes well beyond what most OSINT tools surface. ghunt.sh consolidates that surface in one query.
What ghunt.sh adds to your toolkit
If you run OSINT, you probably already know holehe, Maltego, theHarvester, Sherlock, EpiOSINT and the reference Pipl/Spokeo databases. Each covers a slice. holehe checks where the email is registered. Sherlock scans usernames across platforms. Maltego links the graph. The Google side is the one that is usually treated as a side note.
ghunt.sh fills exactly that slice. From an email, it returns the linked Google account in one consolidated report:
- Public Google profile: display name, photo, locale.
- Gaia ID, the stable internal identifier that lets you chain further lookups.
- Account type: consumer Gmail vs Google Workspace.
- Public Maps contributions, often the richest behavioral signal a Google user leaves.
- Public Calendar events when the account exposes a calendar.
- Play Games profile when applicable.
Why Google signals matter in an investigation
Maps reviews are a goldmine. They are timestamped, geolocated, often photographed, and they accumulate over years. A target who is careful about social media will frequently still have a long trail of restaurant, hotel and shop reviews tied to their main Google account. Cross-referencing those reviews with known travel, residence or work locations is one of the strongest behavioral validations available from public data.
Public Calendar events expose meeting habits, recurring patterns and sometimes counterparties. Play Games tells you the user has an Android account in active use and gives you their gamer tag. The Gaia ID gives you a stable handle to keep pivoting even if the user later renames the account or changes the display name.
Single search or bulk CSV for investigations
Single search from the home page covers ad-hoc lookups during an active investigation. Paste the email, get the report, archive it in your history.
Bulk CSV covers list enrichment: a breach dump, a sanctions list, a fraud cohort, a candidate set. Upload the addresses, the queue runs each through the same engine, and you get a CSV with the consolidated public fields for every resolved row. The single search and the bulk lookup share the same backend, no degraded mode.
Boundaries and ethics
The tool only ever returns data Google itself exposes publicly for the account. It cannot log in, cannot read inbox content, cannot recover credentials, cannot pull private files, cannot bypass MFA, cannot return location history. If the target locked down their profile, the report is empty by design.
ghunt.sh is meant for authorized OSINT: penetration testing engagements with explicit scope, threat intelligence, fraud and AML investigations, journalism, due diligence, academic research. It is not for harassment, stalking, doxxing, or unauthorized targeting of private individuals.
Practical workflow
A typical workflow looks like: holehe to map account registrations, ghunt.sh to consolidate the Google side, Sherlock or namechk to expand usernames, Maltego to connect the graph if scale demands it. ghunt.sh is the step that turns an email into a multi-surface Google identity in one query, instead of querying each Google product manually.
Pricing and sustained work
Single search is free with a soft daily quota per visitor. Sign in to lift the limit. For sustained investigations, the bulk lookup is a paid one-shot purchase, $0.50 per unique email with a 5-email minimum per batch ($2.50). Uploads are queued and run in the background, so you can submit a list and come back to the result later.