Searching a username across hundreds of sites

Many people keep the same username for years, in very different places: a forum, a social network, a gaming platform, a code repository. That is why searching a handle across hundreds of sites is one of the basic OSINT techniques.

It is also one of the most error-prone. A list of fifty "accounts found" looks like a result; unverified, it is mostly a list of hypotheses. This article explains how three open-source tools, WhatsMyName, Sherlock and Maigret, work, why they get things wrong, and how to check what they find.

What it is used for

• Security. Following the handle of an account impersonating your company or an executive, or of someone advertising stolen data on a forum.
• Verification and journalism. Finding out whether the account spreading a piece of content has a history elsewhere or was created yesterday.
• Brand protection. Spotting profiles that use your trading name.
• Self-audit. Finding old accounts of yours that are still open under the handle you have always used.

How these tools work

The idea is simple. Almost every platform has a profile URL with a fixed pattern, such as site.com/user/handle. The tool requests that URL for each site on its list and applies a rule to decide whether the account exists:

• HTTP status code. The profile returns 200 if it exists and 404 if it does not.
• Text on the page. A phrase that only appears on existing profiles, or only on the "user not found" page.
• Redirect. If the handle does not exist, the site sends you somewhere else, such as the home page or a search page.

What sets the tools apart is their list of sites and the quality of their rules.

WhatsMyName

A community project that maintains, on GitHub, a file of several hundred sites with the response expected when an account exists and when it does not. It powers the whatsmyname.app website and other tools such as Blackbird.

Its strength is that every site has both a positive and a negative rule. A response that matches neither is reported as inconclusive rather than as a hit, which cuts down on false positives.

Sherlock

A Python tool with its own list of several hundred networks and rules based on status code, error message or redirect URL. It is simple, and it covers sites WhatsMyName does not, and vice versa.

Maigret

Maigret began as a fork of Sherlock and now has a database of more than 3,000 sites, with engines for common forum software and tags by topic and country. It can also parse the profiles it finds to extract other handles or links and keep searching with them. It is the broadest search, and the slowest.

In Pandora, WhatsMyName runs in the automatic sweep for every handle. Sherlock and Maigret are launched by hand from the entity because they take longer; Maigret covers the most visited sites in its database. Pandora records how many sites each sweep checked and how many returned an account (for WhatsMyName, also how many were inconclusive), and every account is tagged with the database it came from.

Why false positives happen

A "found" result can be wrong for many reasons:

• Pages that return 200 for any handle. Some sites serve a generic page instead of a 404.
• Bot protection and rate limits. A 403, a 429 or a challenge page the rule does not recognise can be read as a profile.
• Redesigns. When a site changes, its rule goes stale until someone updates it.
• Redirects based on language, country or a login wall.
• Sites that generate a page for any name, such as directories and aggregators.

There are false negatives too: blocked requests, private profiles, or handles a site does not allow because of their format (dots, capital letters, minimum length). A handle missing from a site does not prove the person is not there under another name.

Variants and previous names

People change handles, though not always completely: they add a number or a year, an underscore or a dot, or go back to an old name when theirs is taken. Trying variants widens coverage, but every variant also multiplies false positives, because combinations with numbers or years are more common than they look.

Before you start guessing, look at what is already published:

• Some platforms' history. Bluesky and Roblox, for example, keep a public record of an account's previous names.
• What the profile itself links to. A bio pointing to another account gives you the exact handle on that platform, with no need to guess.
• Technical metadata. Commits, published packages and public keys often repeat the same handle or email across several developer platforms.

Pandora adds previous names from Bluesky and Roblox to the graph as handles, each with its source, so you can check them with the same method.

How to verify a hit

A hit is where the work starts, not where it ends. For each account that matters to your case:

1. Open the profile. Check that it is a real page with content, not an empty template.
2. Look at the join date and activity. A profile created yesterday and one with ten years of posts do not carry the same weight.
3. Compare the photo. If two accounts use the same image, a perceptual hash will confirm it even after resizing. Default avatars do not count.
4. Look for cross-links. A bio linking to another network, a personal website, the same email in commit metadata.
5. Compare public keys. On code forges, the same SSH or PGP key on two accounts is very strong corroboration.
6. Compare activity hours. Posting times on each account may point to the same time zone. It is a signal, not proof.
7. Record what you could not check. An unverified result should stay marked as such.

Same handle does not mean same person

This is the central rule of the technique. Usernames are not unique across platforms, and there are several reasons why two accounts with the same handle can belong to different people:

• The handle is a common word, a first name or a frequent combination.
• Someone else registered it first, to reserve it or to impersonate someone.
• The original account was deleted and the name was reused.
• The account is shared, or belongs to an organisation.

A graph with twenty accounts joined by one handle can suggest a connection that does not exist. That is why, in Pandora, the handle is the hypothesis, not the conclusion. The Dossier shows how many distinct sources support each data point and highlights strong corroboration, such as the same public key or the same photo on different accounts. Activity footprints provide measurable signals, each with its source; attributing an account to a person is the analyst's job.

A practical workflow

1. Write down the purpose of the case before you start.
2. Run the WhatsMyName sweep on the handle.
3. Filter: keep the platforms that are relevant to your question.
4. Verify each relevant hit using the steps above.
5. If you need more coverage, run Sherlock or Maigret.
6. Pivot only from verified accounts: an email from a commit, a link in a bio.
7. Record the source, date and confidence level of each conclusion.

This order avoids a costly mistake: building an investigation on an account that turns out to belong to someone else.

Legal and ethical note

Searching for a handle means processing personal data when the handle identifies someone. You need a legitimate purpose, and you should not collect more than necessary: for most questions you do not need every account a person has, only the relevant ones.

Pandora leaves out sites for adult content, dating, health, religion and politics, using the categories the site databases themselves assign. Knowing that someone has an account on them reveals data the GDPR specially protects. And nothing you find justifies contacting, exposing or harassing anyone.

This article is not legal advice.