Email addresses, spammer loves these. Emails is the main source of authentication for most social media platforms. On daily basis, fake social media accounts are used by various cyber criminal. Now days, social media crimes are increasing, because of the Social media popularity. Many users uses bots or automation scripts to become popular in short period of time. According to ethical hacking researcher of International Institute of Cyber Security you can find list of many leaked email address on pastebin and underground links.
There are many cases on cyber bulling, stalking which shows that fake accounts are used. After the investigation, its normally found that fake accounts are the main reason for spreading rumors on any person or public figure to create an chaos among users. Most of the time Twitter becomes the main source for spreading fake news. Every news or chaos are found to be connected with any account. We will show you socialscan which is used to validate email addresses on social media accounts. Users can search by typing email addresses or using any bulk list of email addresses. Socialscan uses various social media platforms, api’s, svc-api’s. Below you can checkout the python script written by socialscan developer which clearly shows instagram, twitter, tumblr or emails, usernames are used to check the availability of email addresses.
- For testing we will use Kali Linux 2018.4 amd64.
- Before installing socialscan, make sure python3 is installed.
- Type open terminal, type sudo apt-get update and then type sudo apt-get install python3, then type sudo apt-get install python3-pip
- Type pip3 –version, If you found error while running pip3, Type sudo apt-get purge python3, then type sudo apt-get install python3-pip
1 2 | root@kali: /home/iicybersecurity/Downloads/socialscan # pip3 --version pip 18.1 from /usr/lib/python3/dist-packages/pip (python 3.7) |
- You can install Socialscan from github or from pip. For installing through github. Type git clone https://github.com/iojw/socialscan.git
- OR type pip3 install socialscan
1 2 3 4 5 6 7 8 9 10 11 12 | root@kali: /home/iicybersecurity/Downloads/socialscan # pip3 install socialscan Requirement already satisfied: socialscan in /usr/local/lib/python3 .7 /dist-packages/socialscan-1 .1.5-py3.7.egg (1.1.5) Requirement already satisfied: aiohttp>=3.5.0 in /usr/local/lib/python3 .7 /dist-packages/aiohttp-4 .0.0a1-py3.7-linux-x86_64.egg (from socialscan) (4.0.0a1) Requirement already satisfied: colorama in /usr/lib/python3/dist-packages (from socialscan) (0.3.7) Requirement already satisfied: tqdm>=4.31.0 in /usr/local/lib/python3 .7 /dist-packages (from socialscan) (4.31.1) Requirement already satisfied: async-timeout<4.0,>=3.0 in /usr/local/lib/python3 .7 /dist-packages/async_timeout-3 .0.1-py3.7.egg (from aiohttp>=3.5.0->socialscan) (3.0.1) Requirement already satisfied: attrs>=17.3.0 in /usr/local/lib/python3 .7 /dist-packages (from aiohttp>=3.5.0->socialscan) (19.1.0) Requirement already satisfied: chardet<4.0,>=2.0 in /usr/lib/python3/dist-packages (from aiohttp>=3.5.0->socialscan) (3.0.4) Requirement already satisfied: multidict<5.0,>=4.5 in /usr/local/lib/python3 .7 /dist-packages (from aiohttp>=3.5.0->socialscan) (4.5.2) Requirement already satisfied: typing-extensions>=3.6.5 in /usr/local/lib/python3 .7 /dist-packages/typing_extensions-3 .7.4.1-py3.7.egg (from aiohttp>=3.5.0->socialscan) (3.7.4.1) Requirement already satisfied: yarl<2.0,>=1.0 in /usr/local/lib/python3 .7 /dist-packages (from aiohttp>=3.5.0->socialscan) (1.3.0) Requirement already satisfied: idna>=2.0 in /usr/lib/python3/dist-packages (from yarl<2.0,>=1.0->aiohttp>=3.5.0->socialscan) (2.6) |
- After then type python3 setyp.py install
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 | root@kali: /home/iicybersecurity/Downloads/socialscan # python3 setup.py install running install running bdist_egg running egg_info writing socialscan.egg-info /PKG-INFO writing dependency_links to socialscan.egg-info /dependency_links .txt writing entry points to socialscan.egg-info /entry_points .txt writing requirements to socialscan.egg-info /requires .txt writing top -level names to socialscan.egg-info /top_level .txt reading manifest file 'socialscan.egg-info/SOURCES.txt' reading manifest template 'MANIFEST.in' writing manifest file 'socialscan.egg-info/SOURCES.txt' installing library code to build /bdist .linux-x86_64 /egg running install_lib running build_py creating build /bdist .linux-x86_64 /egg creating build /bdist .linux-x86_64 /egg/socialscan copying build /lib/socialscan/__init__ .py -> build /bdist .linux-x86_64 /egg/socialscan copying build /lib/socialscan/util .py -> build /bdist .linux-x86_64 /egg/socialscan copying build /lib/socialscan/platforms .py -> build /bdist .linux-x86_64 /egg/socialscan copying build /lib/socialscan/__main__ .py -> build /bdist .linux-x86_64 /egg/socialscan copying build /lib/socialscan/cli .py -> build /bdist .linux-x86_64 /egg/socialscan byte-compiling build /bdist .linux-x86_64 /egg/socialscan/__init__ .py to __init__.cpython-37.pyc byte-compiling build /bdist .linux-x86_64 /egg/socialscan/util .py to util.cpython-37.pyc byte-compiling build /bdist .linux-x86_64 /egg/socialscan/platforms .py to platforms.cpython-37.pyc byte-compiling build /bdist .linux-x86_64 /egg/socialscan/__main__ .py to __main__.cpython-37.pyc byte-compiling build /bdist .linux-x86_64 /egg/socialscan/cli .py to cli.cpython-37.pyc creating build /bdist .linux-x86_64 /egg/EGG-INFO copying socialscan.egg-info /PKG-INFO -> build /bdist .linux-x86_64 /egg/EGG-INFO copying socialscan.egg-info /SOURCES .txt -> build /bdist .linux-x86_64 /egg/EGG-INFO copying socialscan.egg-info /dependency_links .txt -> build /bdist .linux-x86_64 /egg/EGG-INFO copying socialscan.egg-info /entry_points .txt -> build /bdist .linux-x86_64 /egg/EGG-INFO copying socialscan.egg-info /requires .txt -> build /bdist .linux-x86_64 /egg/EGG-INFO copying socialscan.egg-info /top_level .txt -> build /bdist .linux-x86_64 /egg/EGG-INFO zip_safe flag not set ; analyzing archive contents... creating 'dist/socialscan-1.1.5-py3.7.egg' and adding 'build/bdist.linux-x86_64/egg' to it removing 'build/bdist.linux-x86_64/egg' (and everything under it) Processing socialscan-1.1.5-py3.7.egg Removing /usr/local/lib/python3 .7 /dist-packages/socialscan-1 .1.5-py3.7.egg Copying socialscan-1.1.5-py3.7.egg to /usr/local/lib/python3 .7 /dist-packages socialscan 1.1.5 is already the active version in easy- install .pth Installing socialscan script to /usr/local/bin Installed /usr/local/lib/python3 .7 /dist-packages/socialscan-1 .1.5-py3.7.egg Processing dependencies for socialscan==1.1.5 Searching for tqdm==4.31.1 Best match: tqdm 4.31.1 Adding tqdm 4.31.1 to easy- install .pth file Installing tqdm script to /usr/local/bin Using /usr/local/lib/python3 .7 /dist-packages Searching for colorama==0.3.7 Best match: colorama 0.3.7 Adding colorama 0.3.7 to easy- install .pth file Using /usr/lib/python3/dist-packages Searching for aiohttp==4.0.0a1 Best match: aiohttp 4.0.0a1 Processing aiohttp-4.0.0a1-py3.7-linux-x86_64.egg aiohttp 4.0.0a1 is already the active version in easy- install .pth Using /usr/local/lib/python3 .7 /dist-packages/aiohttp-4 .0.0a1-py3.7-linux-x86_64.egg Searching for yarl==1.3.0 Best match: yarl 1.3.0 Adding yarl 1.3.0 to easy- install .pth file Using /usr/local/lib/python3 .7 /dist-packages Searching for typing-extensions==3.7.4.1 Best match: typing-extensions 3.7.4.1 Processing typing_extensions-3.7.4.1-py3.7.egg typing-extensions 3.7.4.1 is already the active version in easy- install .pth Using /usr/local/lib/python3 .7 /dist-packages/typing_extensions-3 .7.4.1-py3.7.egg Searching for multidict==4.5.2 Best match: multidict 4.5.2 Adding multidict 4.5.2 to easy- install .pth file Using /usr/local/lib/python3 .7 /dist-packages Searching for chardet==3.0.4 Best match: chardet 3.0.4 Adding chardet 3.0.4 to easy- install .pth file Installing chardetect script to /usr/local/bin Using /usr/lib/python3/dist-packages Searching for attrs==19.1.0 Best match: attrs 19.1.0 Adding attrs 19.1.0 to easy- install .pth file Using /usr/local/lib/python3 .7 /dist-packages Searching for async-timeout==3.0.1 Best match: async-timeout 3.0.1 Processing async_timeout-3.0.1-py3.7.egg async-timeout 3.0.1 is already the active version in easy- install .pth Using /usr/local/lib/python3 .7 /dist-packages/async_timeout-3 .0.1-py3.7.egg Searching for idna==2.6 Best match: idna 2.6 Adding idna 2.6 to easy- install .pth file Using /usr/lib/python3/dist-packages Finished processing dependencies for socialscan==1.1.5 |
- Type socialscan –help
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 | root@kali: /home/iicybersecurity/Downloads/socialscan # socialscan --help usage: socialscan [-h] [--platforms [platform [platform ...]]] [--view-by {platform,query}] [--available-only] [--cache-tokens] [--input input.txt] [--proxy-list proxy_list.txt] [--verbose] [--version] [query [query ...]] Command-line interface for checking email address and username usage on online platforms: GitHub, GitLab, Instagram, Lastfm, Pastebin, Pinterest, Reddit, Snapchat, Spotify, Twitter, Tumblr, Yahoo positional arguments: query one or more usernames /email addresses to query (email addresses are automatically be queried if they match the format ) optional arguments: -h, --help show this help message and exit --platforms [platform [platform ...]], -p [platform [platform ...]] list of platforms to query (default: all platforms) --view-by {platform,query} view results sorted by platform or by query (default: query) --available-only, -a only print usernames /email addresses that are available and not in use --cache-tokens, -c cache tokens for platforms requiring more than one HTTP request (Snapchat, GitHub, Instagram. Lastfm, Tumblr & Yahoo), reducing total number of requests sent --input input.txt, -i input.txt file containg list of queries to execute --proxy-list proxy_list.txt file containing list of HTTP proxy servers to execute queries with --verbose, - v show query responses as they are received --version show program's version number and exit |
- Type socialscan #######a######@gmail.com, for security purposes the email address is masked.
- socialscan will find accounts with given email addresses.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 | root@kali: /home/iicybersecurity/Downloads/socialscan # socialscan #######a######@gmail.com 0%| | 0 /12 [0.00s] /usr/local/lib/python3 .7 /dist-packages/aiohttp-4 .0.0a1-py3.7-linux-x86_64.egg /aiohttp/client .py:977: RuntimeWarning: coroutine 'noop' was never awaited self._resp.release() RuntimeWarning: Enable tracemalloc to get the object allocation traceback 50%|███████████████▌ | 6 /12 [0.88s] /usr/local/lib/python3 .7 /dist-packages/aiohttp-4 .0.0a1-py3.7-linux-x86_64.egg /aiohttp/client .py:518: RuntimeWarning: coroutine 'noop' was never awaited resp.release() RuntimeWarning: Enable tracemalloc to get the object allocation traceback /usr/local/lib/python3 .7 /dist-packages/aiohttp-4 .0.0a1-py3.7-linux-x86_64.egg /aiohttp/client .py:541: RuntimeWarning: coroutine 'noop' was never awaited resp.release() RuntimeWarning: Enable tracemalloc to get the object allocation traceback 75%|███████████████████████▎ | 9 /12 [1.22s]Future exception was never retrieved future: <Future finished exception=SSLError(1, '[SSL: KRB5_S_INIT] application data after close notify (_ssl.c:2629)' )> Traceback (most recent call last): File "/usr/lib/python3.7/asyncio/sslproto.py" , line 530, in data_received ssldata, appdata = self._sslpipe.feed_ssldata(data) File "/usr/lib/python3.7/asyncio/sslproto.py" , line 207, in feed_ssldata self._sslobj.unwrap() File "/usr/lib/python3.7/ssl.py" , line 778, in unwrap return self._sslobj. shutdown () ssl.SSLError: [SSL: KRB5_S_INIT] application data after close notify (_ssl.c:2629) Future exception was never retrieved future: <Future finished exception=SSLError(1, '[SSL: KRB5_S_INIT] application data after close notify (_ssl.c:2629)' )> Traceback (most recent call last): File "/usr/lib/python3.7/asyncio/sslproto.py" , line 530, in data_received ssldata, appdata = self._sslpipe.feed_ssldata(data) File "/usr/lib/python3.7/asyncio/sslproto.py" , line 207, in feed_ssldata self._sslobj.unwrap() File "/usr/lib/python3.7/ssl.py" , line 778, in unwrap return self._sslobj. shutdown () ssl.SSLError: [SSL: KRB5_S_INIT] application data after close notify (_ssl.c:2629) ---------------------------------------- #######a######@gmail.com ---------------------------------------- Instagram Lastfm Pastebin Twitter GitHub Pinterest Spotify Tumblr |
- Above shows listed of social media platforms that have accounts associated with this searched email address. Below in output social media accounts are mentioned in different colors.
- Socialscan uses two different colors to indicate the presence of email address on social media platform.

- In Yellow Color, it shows email address tested is used in creating accounts on different social media platforms.
- In Green Color, this email address is not used in creating accounts on these platforms.
- Let’s try some other email addresses. For testing, you can found different email addresses on pastr.io.
- Type socialscan ja#####ep#####ki@gmail.com
- As per ethical hacking researcher of International Institute of Cyber Security, socialscan checks the availability of email address by trying to create account or trying to use username suggestion functionality available on social media platforms.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 | root@kali:/home/iicybersecurity/Downloads/socialscan# socialscan ja#####ep#####ki@gmail.com 0%| | 0/12 [0.00s]/usr/local/lib/python3.7/dist-packages/aiohttp-4.0.0a1-py3.7-linux-x86_64.egg/aiohttp/client.py:977: RuntimeWarning: coroutine 'noop' was never awaited self._resp.release() RuntimeWarning: Enable tracemalloc to get the object allocation traceback 58%|██████████████████ | 7/12 [0.69s]Future exception was never retrieved future: <Future finished exception=SSLError(1, '[SSL: KRB5_S_INIT] application data after close notify (_ssl.c:2629)')> Traceback (most recent call last): File "/usr/lib/python3.7/asyncio/sslproto.py", line 530, in data_received ssldata, appdata = self._sslpipe.feed_ssldata(data) File "/usr/lib/python3.7/asyncio/sslproto.py", line 207, in feed_ssldata self._sslobj.unwrap() File "/usr/lib/python3.7/ssl.py", line 778, in unwrap return self._sslobj.shutdown() ssl.SSLError: [SSL: KRB5_S_INIT] application data after close notify (_ssl.c:2629) 75%|███████████████████████▎ | 9/12 [0.83s]/usr/local/lib/python3.7/dist-packages/aiohttp-4.0.0a1-py3.7-linux-x86_64.egg/aiohttp/client.py:518: RuntimeWarning: coroutine 'noop' was never awaited resp.release() RuntimeWarning: Enable tracemalloc to get the object allocation traceback /usr/local/lib/python3.7/dist-packages/aiohttp-4.0.0a1-py3.7-linux-x86_64.egg/aiohttp/client.py:541: RuntimeWarning: coroutine 'noop' was never awaited resp.release() RuntimeWarning: Enable tracemalloc to get the object allocation traceback 83%|█████████████████████████ | 10/12 [1.43s]Future exception was never retrieved future: <Future finished exception=SSLError(1, '[SSL: KRB5_S_INIT] application data after close notify (_ssl.c:2629)')> Traceback (most recent call last): File "/usr/lib/python3.7/asyncio/sslproto.py", line 530, in data_received ssldata, appdata = self._sslpipe.feed_ssldata(data) File "/usr/lib/python3.7/asyncio/sslproto.py", line 207, in feed_ssldata self._sslobj.unwrap() File "/usr/lib/python3.7/ssl.py", line 778, in unwrap return self._sslobj.shutdown() ssl.SSLError: [SSL: KRB5_S_INIT] application data after close notify (_ssl.c:2629) ---------------------------------------- ja#####ep#####ki@gmail.com ---------------------------------------- GitHub Lastfm Pastebin Instagram Pinterest Spotify Tumblr Twitter |
- Above shows social media accounts which are connected with the given email addresses. Socialscan uses two different colors to indicate on which social media platform.

- In Yellow Color, it shows above email address is used in creating accounts on different social media platforms.
- In Green Color, this email address is not used in creating accounts on these platforms.
- In Social media crimes, Digital forensics investigator can use Socialscan for verifying the email addresses. Or if any user received some spamming emails from any email ID. User can check the social media behavior of that account by finding social media accounts using Socialscan.
- In some common email addresses, it might shows false positives but still according to its developer it provides 100% accuracy.
- While searching accounts on social media, we do found account with particular email address on social media platforms. For further verification, you can manually search for the email ID on social media logins. For verification we have used above first email ID for verifying on twitter.com For security reasons, we have masked the email id.

- Above shows that “we could not identify you by the email address. Please enter your username to first your account” which means that twitter does not have any account using above email. For security purposes, we have hidden the email id.
Scanning List of Email Addresses
- Type socialscan –platform instagram –input list2.txt
- –platform to write any particular platform. We have searched for Instagram.
- –input is used to enter list of email addresses.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 | root@kali: /home/iicybersecurity/Downloads/socialscan # socialscan --platform instagram --input list2.txt 0%| | 0 /37 [0.00s] /usr/local/lib/python3 .7 /dist-packages/aiohttp-4 .0.0a1-py3.7-linux-x86_64.egg /aiohttp/client .py:518: RuntimeWarning: coroutine 'noop' was never awaited resp.release() RuntimeWarning: Enable tracemalloc to get the object allocation traceback /usr/local/lib/python3 .7 /dist-packages/aiohttp-4 .0.0a1-py3.7-linux-x86_64.egg /aiohttp/client .py:541: RuntimeWarning: coroutine 'noop' was never awaited ---------------------------------------- kkne ########3@gmail.com ---------------------------------------- Instagram ---------------------------------------- slo #######en@gmail.com ---------------------------------------- Instagram ---------------------------------------- jame ##########ki@yahoo.com ---------------------------------------- Instagram ---------------------------------------- Ky #########ps@hotmail.com ---------------------------------------- Instagram ---------------------------------------- gia #########ris@gmail.com ---------------------------------------- Instagram ---------------------------------------- big ##########@gmail.com ---------------------------------------- Instagram ---------------------------------------- th ##########erjwo@yahoo.com ---------------------------------------- Instagram ---------------------------------------- chu ##############her@yahoo.com ---------------------------------------- Instagram ---------------------------------------- kin #########94@gmail.com ---------------------------------------- Instagram ---------------------------------------- con #########17@gmail.com ---------------------------------------- Instagram ---------------------------------------- car ########g@gmail.com ---------------------------------------- ---------------------------------------- sir #########lker@gmail.com ---------------------------------------- Instagram Available, Taken /Reserved , Invalid, Error Completed 12 queries in 4.38s |
- Above shows list of email addresses which are taken or they are available.

Cyber Security Researcher. Information security specialist, currently working as risk infrastructure specialist & investigator. He is a cyber-security researcher with over 25 years of experience. He has served with the Intelligence Agency as a Senior Intelligence Officer. He has also worked with Google and Citrix in development of cyber security solutions. He has aided the government and many federal agencies in thwarting many cyber crimes. He has been writing for us in his free time since last 5 years.