MailAccess is a self-hostable email OSINT platform that fans an address out across breaches, social platforms, and the open web, returning a unified exposure score and structured findings for authorized analysts.
| Tool | KatrielMoses/MailAccess — self-hostable email OSINT platform with breach, social, and DNS correlation, MIT licensed, pip install mailaccess |
| Category | OSINT / email reconnaissance and threat intelligence, written in Python 3.10+ |
| Primary Use | Investigating a single email via mailaccess investigate, harvesting organizational addresses with harvest-emails --domain, and resolving likely addresses from names with find-email |
| Safe Use | Built for security researchers, OSINT analysts, and penetration testers operating under explicit authorization; the project ships a DISCLAIMER.md and states all queried data comes from public sources |
| Telemetry Note | Probes generate observable HTTP requests to ~700 vetted platforms and breach corpora by default; defenders see distributed account-existence checks and registration lookups originating from the operator's egress IPs, which residential-proxy sponsors are marketed to obscure |
MailAccess positions itself as a self-hostable OSINT platform for investigating email addresses, and the scope described in the README is unusually broad for a single CLI. Given one address, it fans out across breach databases, social networks, DNS records, and the open web, then consolidates everything into a unified exposure score and structured findings suitable for export or piping into Maltego. The project is MIT licensed, written in Python 3.10+, distributed on PyPI, and deployable either as a lightweight CLI or as a full Docker Compose web stack with PostgreSQL, WebSocket events, and a REST API. With 1,379 stars at the time of writing, it has clearly found an audience among OSINT practitioners.
Installation is deliberately frictionless: pip install mailaccess followed by mailaccess investigate you@example.com is the entire baseline workflow. The CLI auto-starts and auto-stops a backend process for each investigation, which abstracts away the client-server split entirely for ad-hoc use. For persistent deployments, mailaccess serve keeps the backend alive, and optional extras extend capability: mailaccess[ml] adds spaCy-based name classification while mailaccess[browser] (plus playwright install chromium) enables a headless-browser tier of account-existence oracles for platforms that resist simple probing. That tiering — fast HTTP checks first, browser fallback for stubborn targets — is a sensible architecture that avoids spinning up Chromium for every check.
The core investigative engine is what the README calls a 5,300+ platform corpus, a natively verified set of platform definitions queried by a username-platform engine with two-marker detection and, notably, zero runtime dependencies. Within that corpus, 357 services are flagged as directly email-checkable — consumer apps, SaaS products, and community forums — and are probed non-intrusively for account existence. A native Google-account intelligence module and a deep breach mode that probes the highest-severity breach corpus round out the direct email tooling. Importantly, a full investigation does not blindly hit all 5,300 platforms: the engine probes a bounded, evidence-first wave of roughly 700 vetted, high-signal platforms by default, which keeps runtimes and noise manageable.
Where MailAccess gets genuinely interesting analytically is its correlation layer. The identity graph cross-links accounts, usernames, names, avatars, breach data, and profile links across platforms, viewable at /investigation/:id/graph or exported via GET /api/report/{id}/graph. On top of that sits a Name Consensus Engine that synthesizes independent name signals into graded bands — confirmed, probable, possible, or unknown — rather than asserting identity on a single match. This is a meaningful design choice, because naive email OSINT tools are notorious for conflating same-name accounts across services. The project even maintains a dedicated docs/fp-control.md covering common-name handling, disposable-domain filtering, clustering, health, and scoring controls, which signals real attention to false-positive discipline.
Two distinct scores frame the output. A Credential Risk Score is a 0-100 band with top drivers and recommended next steps, aimed at quantifying how exposed a given identity's credentials are given breach and account-existence evidence. Alongside it, the Defender's Brief produces a security-manager-ready risk summary with prioritized findings and a concrete next action — a nod to the reality that most OSINT reports die as raw data dumps that non-technical stakeholders never act on. The fact that the tool explicitly writes for a defender audience, not just red-team consumers, is a differentiator worth noting.
Beyond single-address investigation, MailAccess offers organizational reconnaissance. harvest-emails --domain company.com discovers employee addresses across Common Crawl, GitHub, certificate transparency logs, registries, keyservers, dorks, employee pages, and naming patterns — the standard open-source harvesting surface, consolidated into one command with --export harvest.csv output. Complementing it, find-email --name "Jane Doe" --domain company.com works entirely offline from a bundled 384K-domain pattern index, returning one honestly-graded likely address and verifying Microsoft 365 mailboxes where the provider allows verification. In an authorized engagement scope, these two commands cover the pre-engagement email enumeration phase that testers would otherwise assemble from half a dozen separate scripts.
The monetization layer deserves scrutiny, because it shapes what the free tool actually does. MailAccess Pro adds business-contact enrichment — names, roles, companies, emails, and LinkedIn profiles aggregated from public and commercial third-party sources — targeted at lead generation rather than security work. The README is transparent about the boundary: Pro contacts are live-only, never touching local exports, the database, or history, and every free harvest prints exactly how many additional contacts Pro would surface before any payment. At $5/month for the first 100 seats, it is a commercial corpus bolted onto an MIT-licensed core, and the security-focused modules function fully without a key.
The README is also candid about network dependencies and egress. Most modules run with zero API keys; optional keys unlock coverage, with mailaccess keys set HIBP_API_KEY your-key for Have I Been Pwned and an optional ipgeolocation.io key powering the ip_intel module, which enriches already-collected IPs with location, owner, risk flags, and abuse contacts on a 30-day cache that --refresh bypasses. The sponsor roster is telling: five of the six sponsors are residential and ISP proxy providers explicitly marketed for scraping and harvesting at scale. Analysts should read that as a signal about the tool's heavy-request operating profile and factor the associated legal exposure into any engagement that lacks explicit authorization for the target domains involved.
Output plumbing is mature. Six export formats — JSON, CSV, PDF, Markdown, STIX 2.1, and Maltego XML — cover everything from quick triage to formal threat-intel interchange, with -o report.pdf on the investigate command itself. The STIX 2.1 support in particular means findings drop cleanly into existing TIP pipelines, and the Maltego XML exporter plus documented Maltego setup in the self-hosting guide makes it practical for analysts who live in graph-based workspaces. Slack, Discord, and generic webhook integrations are documented in docs/integrations.md, alongside stdin/JSONL and CI patterns, so MailAccess can sit mid-pipeline rather than as a terminal tool.
Operationally, the tool checks PyPI for newer releases on a best-effort, cached, non-blocking basis and prints an upgrade hint when behind, with mailaccess upgrade for in-place updates and MAILACCESS_NO_UPDATE_CHECK=1 to silence the check. Self-hosting via Docker Compose with proxy and Tor configuration options is covered in docs/self-hosting.md, which matters for teams that need to control egress identity or keep investigation data entirely on-premises — a genuine compliance consideration when handling breach-adjacent data about real people.
From a defensive perspective, MailAccess is as useful to blue teams as to testers. The breach-exposure and credential-risk scoring gives security managers a defensible, evidence-graded picture of which employee identities warrant credential resets or targeted awareness work, and the Defender's Brief is explicitly written for that audience. Defenders should also understand its observable footprint: a run generates account-existence probes and registration lookups against hundreds of services from the operator's egress addresses, a pattern that abuse teams at consumer platforms see constantly. For anyone running phishing-simulation programs or attack-surface reviews of their own domain, harvest-emails against their own organization is a direct way to measure what an adversary's recon phase would find.
Caveats are the usual ones for aggregated OSINT: correlation confidence is only as good as the graded bands, breach data reflects past exposure rather than current compromise, and the Pro corpus introduces third-party data of unverified provenance into results. The project's own DISCLAIMER.md and authorized-use framing, plus its false-positive control documentation, suggest a maintainer who takes responsible use seriously. For authorized penetration testers, OSINT analysts, and defenders mapping their organization's public email footprint, MailAccess consolidates what is normally a fragmented toolchain into one coherent, exportable pipeline — and the zero-API-key baseline makes it trivially easy to evaluate.
KatrielMoses/MailAccess.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.