An email is the most convenient identifier to check. People give it at sign-up almost everywhere, it lives for years and is rarely shared, unlike a username such as "alex". A real address in use usually gathers a trail: service sign-ups, public commits, an avatar, linked profiles. An address made yesterday for one application has no trail, and that is an answer too.
Where the address is registered
The first question is which services have an account with this email. Oracul checks the address on ~2700 sites with user-scanner and on ~120 services with holehe. How matters: no password resets and no sign-up attempts. The owner gets no email and never learns about the check.
Public profiles linked to the address
- Gravatar: the avatar and accounts the owner linked to the address.
- GitHub: commits signed with this email and their author's profile.
- GitLab: profiles that show this address as public.
These sources matter because the owner left the link there. From each profile Oracul takes new entry points (usernames, links from the bio, other emails) and scans them in the next round. One address becomes a graph: which username came from which commit, which profile from which link.
Breaches
On paid plans the address is checked against the public XposedOrNot breach database. If the email is in breaches with passwords, the signals carry breached_credentials: the account may be taken over, and the applicant may not be the address owner. For security teams it also shows what an attacker sees.
How old the address is
Sign-up and activity dates of the accounts found form a timeline. The earliest date is the footprint age. If the oldest account is under 180 days, young_footprint fires; with no confirmed or probable account at all, no_footprint. Your rules decide what to do: a young trail is normal for a new work address and worth a second look for a large application.
What an email cannot tell
- The mailbox or its messages: Oracul never logs into other people's accounts.
- Closed networks: VK, X, Instagram, TikTok and Facebook need a login, so they are marked "closed" and not touched.
- Proof that the address owner is the applicant. A sign-up shows the address is alive, not who uses it right now.
A name next to the address
An email is stronger with the first and last name from the application. Oracul then compares them with names in the profiles found, with transliteration. If names differ, name_mismatch fires. If they match on several sites, account confidence grows and namesakes stay out of the profile.
How to run it
POST /v1/scans with the email (and a name, if you have one), or "New scan" in the console. Quick mode takes a few minutes, and a webhook signed with HMAC-SHA256 arrives when it is done. Emails, phones and breaches never go to external models, and the result is deleted after 30 days or earlier with one DELETE /v1/scans/{id}.