DeepIntel breach hits with source labels.
An email address is one of the best seeds for breach search. Each hit names a source and a leak date, so a single address can become a timeline of where the person signed up and what leaked.
Search the exact address
- Enter the full address first, for example the one from a ticket or a profile
- Then search the part before the @ as a username
- Search the domain only if you also need the other staff addresses
Read the source and the date
Every hit names the breach it came from and when it leaked. The exposure type tells you what the row contained, for example a password in plain text or a hash. An old hit may describe an account the person no longer uses, so treat the date as part of the evidence.
Build the timeline
- Sort the hits by leak date, oldest first
- Note the first appearance of the address and the services it was used on
- Write down every new username, name or other identifier a row includes
- Mark hits that share a password type or a username, they often belong to the same person
Pivot from what you find
- New usernames go to Social Username search
- Domains in the hits show where the person worked or played
- Discord IDs go to the Discord, Roblox and FiveM modules
- Any new address goes back into breach search
Do not merge accounts too fast
A common username or a shared family address can belong to several people. Merge two hits only when a second identifier matches, such as a name, a domain or a Discord ID.
Search only for targets you are allowed to investigate, and read the ethics policy first.
