I Ran My Own Email Through SpiderFoot. Here's What an Attacker Would See (and How to Check Yours)

Paradox — Thu, 05 Nov 2026 19:18:56 +0000

Before someone sends you a convincing phishing email, they do their homework. They look up your email address, find which accounts it's linked to, and use that to write a message that sounds real.

I wanted to see that homework from the attacker's side. So I ran my own email address through SpiderFoot, a free OSINT tool, on my Kali machine.

This post shows how to do the same for yourself: setup, running the scan, reading the results, and the cleanup checklist I'd follow afterwards.

Ground rule: only scan targets you own or have written permission to test. Your own email, your own usernames, your own domain. That's the whole point of this guide.

What is SpiderFoot?

SpiderFoot is an open-source OSINT automation tool. You give it a target (an email address, username, domain, IP address or name) and it queries 200+ modules: search engines, breach databases, social platforms, DNS and more. It then connects everything it finds into one picture.

It runs locally and comes with a web interface, so you don't need to be a command-line expert to use it.

Setup

Option 1: Kali Linux (SpiderFoot is in the repositories)

sudo apt update && sudo apt install spiderfoot
spiderfoot -l 127.0.0.1:5001

Option 2: any Linux machine, from source (what I did)

git clone https://github.com/smicallef/spiderfoot.git
cd spiderfoot
python3 -m venv venv && source venv/bin/activate
pip install -r requirements.txt
python3 ./sf.py -l 127.0.0.1:5001

Then open http://127.0.0.1:5001 in your browser. Binding to 127.0.0.1 keeps the web interface reachable only from your own machine.

Running a scan on your own email

Click New Scan.
Give it a name. Mine was just XXXX.
Enter your own email address as the target. SpiderFoot detects the target type automatically.
Under By Use Case, choose Passive. Passive modules only collect information from third-party sources and never touch the target directly. For a self-check, that's exactly what you want.
Click Run Scan Now.

While it runs, the Log tab shows each source being queried. Depending on the modules and your connection, a scan takes anywhere from a few minutes to much longer.

Tip: some modules only return results with an API key (for example breach databases or email lookup services). You can add keys under Settings. Many offer a free tier.

Reading the results

SpiderFoot gives you several views of the same data:

Summary: how many data elements were found, grouped by type.
Browse: the actual findings, sorted by data type. Start here.
Graph: a visual map of how everything connects.
Correlations: findings SpiderFoot flags as risky, rated High / Medium / Low / Info.

The Graph view was the eye-opener for me. My email sat in the middle, with lines out to the accounts linked to it.

It found several accounts linked to my address.

Individually, each finding is harmless. Together, they're exactly what an attacker needs: which services I use, which ones I'd trust an email from, and which old accounts might still have a weak password.

Why this matters

With this information, an attacker can:

Write a believable phishing email, pretending to be a service they know you actually use.
Try leaked passwords from old breaches against accounts tied to the same email (credential stuffing).
Target forgotten accounts that still use an old password and have no 2FA.

None of this needs "hacking". It's public information, connected.

Cleanup checklist

Here's what I'd do after a scan like this:

Delete accounts you no longer use. Forgotten accounts are the weakest link.
Use a separate email for sign-ups and newsletters. Keep your main address for banking, work and people you know. Email alias services make this easy.
Check your email on Have I Been Pwned. If it shows up in a breach, change that password and anywhere you reused it.
Turn on 2FA for every account that matters, preferably with an authenticator app or a security key instead of SMS.
Use unique passwords with a password manager, so one leak doesn't unlock everything.
If you're in the EU, use your right to erasure. People-search and data-broker sites have to delete your data on request (GDPR Article 17).

Then run the scan again in a few months and compare.

Wrapping up

The scariest part of my scan wasn't any single result. It was seeing how easily the pieces connect.

Run it on yourself, clean up what you find, and you'll be a much harder target than most.

I post practical privacy and security tips on X: @Paradoxl4e. Only ever scan yourself.

DEV Community: Paradox