OSINT Jet · Email evidence

Gmail Aliases in OSINT: When Dots and Plus Tags Matter

Two pages show slightly different email addresses. One contains a dot; the other adds a word after a plus sign. Should you merge the records? First decide what you are comparing: the exact text, a possible delivery destination, an account on another website, or a person. Those are four separate claims.

Start with the exact address, not the cleaned version

Keep the address exactly as it appeared, together with its source and date. If you make a comparison version, put it in a different field. Overwriting the original loses the detail that might later explain how an address was used.

A plus tag can be a useful label chosen for a mailing list or another purpose. It is not proof of registration with the service named in the tag. Someone can type a word into an address without ever using that service. Likewise, an address printed on a public page is evidence that the page printed it—not proof that the page author controls the mailbox.

This guide covers address comparison. For researching a domain, a message or a sender’s claim, continue with the broader email OSINT workflow.

The Gmail rule has a boundary

Google’s Gmail help states that dots do not distinguish consumer @gmail.com addresses. It explicitly separates work, school and organization addresses, where dots can change the address. Do not apply the consumer rule merely because an organization uses Google’s mail service.

Google also describes using a plus tag to organize incoming Gmail. That is a delivery feature. A third-party website may store or compare the full address differently; the mailbox provider’s behavior does not establish that website’s account policy.

For another provider or a custom domain, check the relevant documentation before transforming anything. If you cannot confirm the rule, preserve both strings as separate observations. You can record a possible relationship without deleting the uncertainty.

Use a four-column comparison instead of an identity shortcut

Notice the extra question in the second row: a syntactically equivalent destination is not a mailbox-existence test. You do not need to send messages, trigger password recovery or probe signup forms to explain a documented comparison rule.

A small example with three different outcomes

Symbolic teaching example; no addresses below are lookup targets. Imagine two consumer Gmail strings with the same letters in the local part but dots in different positions. Keep the two original observations. You may group them under a Gmail-specific delivery comparison key, with the rule attached. You have not discovered two different people or established who owns the mailbox.

Now imagine a second string that adds +conference to that Gmail base. Retain the tag in the evidence. It may help distinguish which text appeared on which page, but it does not prove that the mailbox holder attended a conference, registered an account or supplied the address personally.

Finally, compare the fictional custom-domain strings m.rahimi@example.org and mrahimi@example.org. The Gmail consumer rule does not apply. Leave them separate unless there is specific evidence explaining their relationship. A matching display name or the fact that both sites use a familiar mail provider is not that evidence.

Keep a reversible normalization log

Normalization means making a comparison copy according to an explicit rule. It should not silently rewrite your evidence. A compact record is enough:

Original observation → source URL and date
Comparison copy → exact transformation, if any
Rule → provider documentation and applicable domain
Supported statement → what the comparison establishes
Unresolved statement → what still needs evidence

Before joining two records, ask a colleague—or your future self—to reconstruct the decision from those fields. If the only explanation is “the tool cleaned both addresses,” the record is not ready. Keep the originals and mark the proposed join for review.

Also keep source dependence in view. Five directories copying the same address are five appearances, not necessarily five independent confirmations. The comparison log explains how text relates; it cannot manufacture independent evidence.

Use the saved differences to ask a better question

A useful investigation brief says: “These two public pages display these exact variants. This provider rule may connect their delivery route, but the relationship between the pages is unverified.” That gives a researcher a precise job. “Find everything about this person” hides the uncertainty inside the request.

OSINT Jet’s email investigation workflow describes organizing email, domain and related public clues into a reviewable case. Preserve the original forms when preparing your input and explain any proposed grouping. The value to assess is whether the resulting case keeps sources and uncertain relationships clear—not whether it returns the longest list of matches.

If documentation resolves a simple formatting question, no paid search is needed. If conflicting public pages, companies or aliases remain, compare the available investigation options and bring the comparison log into the case. Share only relevant evidence, following the responsible research standards.