Every reset ends at the mailbox
Password resets, new device confirmations and identity checks all deliver a code to the recovery address. Whoever can open that inbox can take the account back, and whoever cannot will eventually lose it.
Loading HstockPlus
Enter your recovery email and click Query. We match the domain to common webmail login guides. The list is updated over time.
No results yet
Buyers tend to treat the attached mailbox as packaging. It is closer to the deed. Almost every recovery path for a social account terminates in an inbox somebody has to be able to open.
Password resets, new device confirmations and identity checks all deliver a code to the recovery address. Whoever can open that inbox can take the account back, and whoever cannot will eventually lose it.
Mailboxes attached to accounts are frequently hosted somewhere a buyer has never used, and a firstmail login page looks nothing like a consumer one. Knowing where to log into recovery email inboxes is often the only thing standing between a delivered order and a usable one.
A match returns four things rather than just a name, because knowing the provider is only useful if you also know how to get in and what to look for.
The account recovery mailbox provider is named outright. Alias domains resolve to their real operator, so a googlemail address is named as Gmail rather than treated as something separate.
The link goes to the sign-in page for that provider. For an unrecognised domain you still get an openable address built from the domain itself, which is usually where its webmail lives.
To read verification code from recovery email you need more than a provider name. Recognised entries carry a short instruction describing how to sign in and what to search for, typically verification messages from the platform that issued the code.
The result states plainly if the domain is not in the table. That is the difference between a provider we can describe and a guess.
The table deliberately includes throwaway mail services alongside the real ones, because a disposable email domain check is more valuable than a blank result.
The window where an order can still be fixed cheaply is short. This is the order of operations that keeps it open.
Run the address through the lookup first. This is the cheapest step and it decides whether the rest are worth doing.
The lookup names the provider and links the login page. It cannot know whether the password you were given is correct, and that is the fact you need next.
Existing verification messages tell you which platforms this mailbox has been used for, which is sometimes more than the listing disclosed.
Once you can read the inbox, point the account at a mailbox under your control. Until that is done, the seller still holds a path back into the account.
This is a domain identification tool and nothing more. Being clear about that prevents a match from being read as a clean bill of health.
No credentials are used and no login is attempted. A recognised provider tells you where to go, not that you will get in when you arrive.
The lookup reads the part of the address after the at sign. A perfectly valid provider can be named for an address that was never created.
The provider table is bundled into the page, so the address you paste is not transmitted anywhere. There is no quota and no charge on any number of lookups.