Substack OSINT & Safety Guide (2026): Profiles, Scams, AI

What can you learn from a Substack account?

The short answer

For investigators: start at substack.com/@handle. A profile can show the person's bio, the publications they read, their posts, Notes and likes Substack Help Center, profile (updated 2 Feb 2026). Follower and following lists are "public by default and cannot be hidden" Substack Help Center, following (updated 10 Sep 2026). A publication's /feed, /archive, /about and /sitemap pages list its output and contributors.

For writers: hide your reads and likes, and keep your personal phone off Stripe receipts Substack Help Center, Stripe phone and email (updated 29 Jan 2026). Turn on two-factor sign-in Substack Help Center, two-factor authentication (updated 20 Apr 2026) and limit who can message you Substack Help Center, direct messages (updated 10 Aug 2026). A checkmark on Substack is a sales badge, not identity verification Substack Help Center, verification (checked 16 Oct 2026), so treat "verified-looking" accounts that message you with care.

For readers: your address may be in the February 2026 breach. Have I Been Pwned lists 663.1k affected addresses, with emails and some phone numbers Have I Been Pwned (checked 16 Oct 2026). Be wary of messages about your Substack subscriptions or payments.

What does a Substack profile reveal?

A lot, by default. Substack says a profile shows "Your photo and bio" and "What publications you read". It also shows the posts and Notes you published or liked, and "a subset" of your subscribers or followers Substack Help Center, profile (updated 2 Feb 2026).

Reads can be hidden one by one. The "Subscription Privacy" section has a toggle for each newsletter Substack Help Center, profile (updated 2 Feb 2026). Many people never touch it, so the list is often a good picture of someone's interests.
Likes are public until switched off Substack Help Center, profile (updated 2 Feb 2026).
Followers and following cannot be hidden. "Anyone can see your followers list to see who follows you and who you are following" Substack Help Center, following (updated 10 Sep 2026).
Paid badges show how many paid subscriptions someone holds, in tiers of 1+, 5+ and 10+, and how long they have paid cannot be hidden Substack Help Center, badges (updated 2 Feb 2026). The badge itself can be turned off Substack Help Center, profile (updated 2 Feb 2026).
Handles change. "If you change your handle, your old handle will be free for any user to claim" Substack Help Center, handles (updated 2 Feb 2025). Record the numeric profile ID as well as the handle; it appears in links of the form substack.com/profile/1234567-name.
A writer's subdomain is reserved as their handle Substack Help Center, handles (updated 2 Feb 2025), so name.substack.com usually leads to substack.com/@name.

Substack's privacy policy also says public profile data "may be shared or accessed via automated means (e.g., APIs or indexing services)" Substack Privacy Policy (updated 14 May 2026). Assume anything public is being copied.

Which Substack URLs help an investigation?

URL	What it shows	Notes
`substack.com/@handle`	Bio, publications read, posts, Notes, likes, some followers Substack Help Center, profile (updated 2 Feb 2026)	Replaced the old `substack.com/profile/1234567` form Substack Help Center, handles (updated 2 Feb 2025). Tab contents load with JavaScript.
`name.substack.com/archive`	Every public post, newest first	Listed in Substack's own sitemaps (tested on on.substack.com).
`name.substack.com/about`	Publication description and the "People" who write it	Contributors set to public appear here Substack Help Center, contributors (updated 26 Jul 2026).
`name.substack.com/feed`	RSS feed with author names and publish dates	Also works on custom domains, where it reports "Generator: Substack" (tested 16 Oct 2026). Add it to any RSS reader to watch for new posts.
`name.substack.com/sitemap` and `/sitemap/2026`	All post titles by year	Year pages list titles without dates (tested on a live publication). Some publications refuse automated readers.
`name.substack.com/recommendations`	Newsletters the writer recommends	List loads with JavaScript; open it in a browser.

Replace name and handle with the real values. We tested each pattern on live publications on 16 October 2026.

Private publications still leak a little. Their posts are hidden, but "The Welcome page is indexed in search engines" Substack Help Center, private publications (updated 17 Dec 2025). Emails from a private publication can also be forwarded to anyone Substack Help Center, private publications (updated 17 Dec 2025).

Comments are visible but not meant for indexing. Substack's standard robots.txt tells crawlers to skip comment permalinks (/p/*/comment/*) and Note posts (tested on two publications). Search engines may miss them, so read the post page itself.

How do you tell a site runs on Substack?

Look for three signs. Many newsletters use their own domain, which hides the substack.com address.

DNS. Substack tells writers to point a CNAME record at target.substack-custom-domains.com Substack Help Center, custom domains (updated 1 Oct 2026). Look up the domain in our domain lookup; a CNAME to that target means Substack.
Page assets and links. On a custom-domain site we tested, images loaded from substackcdn.com, the footer linked to substack.com's privacy and terms pages, and the RSS feed said "Generator: Substack".
The hidden subdomain. On the same site, the original name.substack.com address appeared inside the encoded social-preview image link in the page source. Substack also says a writer's settings stay reachable at [yoursubdomain].substack.com/publish/settings Substack Help Center, custom domains (updated 1 Oct 2026), so the subdomain keeps existing behind the custom domain.

Once you have the subdomain, you have the writer's likely handle, and from there the profile.

How do you map a Substack writer's network?

Use what the writer chose to make public.

Recommendations appear after someone subscribes, on the publication's homepage and in digest emails Substack Help Center, recommendations (updated 2 Mar 2026). The recommended writer is told by email Substack Help Center, recommendations (updated 2 Mar 2026).
Following lists are always public Substack Help Center, following (updated 10 Sep 2026).
Likes and comments show who engages with whom. Commenters need a Substack profile Substack Help Center, comments (updated 26 Jul 2026).
Contributors and guest writers appear on the About page and in bylines Substack Help Center, contributors (updated 26 Jul 2026).

Since August 2026, Substack's "creator match" feature suggests collaborators with similar audiences On Substack (25 Aug 2026), so a link between two writers can be prompted by the platform. Mapping public connections is fine for research; using them to pressure or harass someone is not. Substack bans using private information "to intimidate, harass, or threaten others" Substack Content Guidelines (updated 29 Sep 2026). Our Is OSINT legal? guide covers the limits.

What does Substack's AI-text scan show, and can writers opt out?

Since 21 July 2026, any reader can ask for an AI estimate on a post, Note, reply or comment. The scan uses Pangram. It works on "text longer than 100 words, published from today on" and shows the result "only to those who request it" Chris Best, The Substack Post (21 Jul 2026). It covers posts and Notes published on or after 21 July 2026. It does not run on video or audio posts, or on posts viewed on custom-domain sites Substack Help Center, detecting AI (updated 9 Aug 2026).

Writers can switch it off per post. "On the Publish page of a draft post, click Disable AI detection." It has to be done manually for each post Substack Help Center, detecting AI (updated 9 Aug 2026).
Opting out can be visible. A reader setting called "Label content", off by default, badges posts that Pangram scores as 100% AI-generated. "It also adds a badge when the author has turned AI detection off" Substack Help Center, feed controls (updated 14 Oct 2026).
Account-wide opt-out. Substack's Help Center describes only the per-post switch Substack Help Center, detecting AI (updated 9 Aug 2026). Privacat reported on 5 August 2026 that a request to [email protected] can now disable scanning for a whole account Privacat Insights (updated 5 Aug 2026). We have not seen Substack confirm this.
The contract changed first. The Publisher Agreement updated on 20 July 2026 grants Substack "a limited license to submit your content to automated analysis tools". It says the tools are "prohibited from retaining your content", and the licence does not allow training third-party AI models Substack Publisher Agreement (updated 20 Jul 2026).

How much to trust a score. The launch post calls Pangram "not perfect" Chris Best, The Substack Post (21 Jul 2026). A score is a probability, not proof of how a text was written. Our stylometry guide explains why writing style can mislead, and our AI image detector covers images.

What did the 2026 Substack breach expose?

Email addresses, phone numbers and internal metadata, accessed in October 2025. Substack's CEO told users that a problem "allowed an unauthorized third party to access limited user data". He said "This data was accessed in October 2025", and that "credit card numbers, passwords, and financial information were not accessed" Security Affairs (5 Feb 2026). Substack detected it on 3 February 2026 CyberInsider (5 Feb 2026).

How many? A file of 697,313 records was posted on a hacking forum; that is the attacker's figure CyberInsider (5 Feb 2026). Have I Been Pwned loaded 663.1k unique email addresses on 6 February 2026, with phone numbers for some Have I Been Pwned (checked 16 Oct 2026).
What else? The leaked file reportedly also held names, user IDs, Stripe customer IDs, profile pictures and bios CyberInsider (5 Feb 2026). Substack did not confirm those fields.
What to do. Check your address on Have I Been Pwned, and follow the CEO's advice to "take extra caution with any emails or text messages you receive that may be suspicious" Security Affairs (5 Feb 2026). Messages that mention your Substack subscriptions or payments are the obvious lure.

Use our Email Lookup to run the breach check, and our HIBP catalog browser to see what the Substack breach entry lists.

How do Substack impersonation scams work?

Scammers copy a writer's name and photo, then contact that writer's readers. In October 2026 the finance writer Charlie Garcia described clone accounts that liked and commented to look familiar, then pushed readers to WhatsApp or Telegram "insider" and trading groups. He wrote that "189 of you got a notification from one" and that Substack "banned 21 accounts from my screenshots" Charlie Garcia, Capital Mischief (13 Oct 2026). He also reported new controls: "Since September 14, no new account can message my subscribers without review" and "wa.me links are now held for review" Charlie Garcia, Capital Mischief (13 Oct 2026). Those controls are his account; we found no Substack Help Center page confirming them.

Checks before you trust a message:

A checkmark proves nothing about identity. Substack says its purple, orange or white checks are bestseller badges for paid subscriptions, "unlike a verification badge seen on other platforms" Substack Help Center, verification (checked 16 Oct 2026).
Compare the handle and numeric ID with the real writer's profile linked from their publication. A clone uses a different handle.
Real writers rarely move you to WhatsApp, Telegram or crypto. Treat any such request as a scam. Our pig-butchering scam guide and text and QR scam guide show the common patterns.
Report and block. Use the three-dot menu on the profile, choose Report and pick Impersonation. Substack defines it as accounts "pretending to be another person, brand, or organization in a misleading way" Substack Help Center, reporting content (updated 1 Jul 2026). Reports go to Substack's enforcement team, which aims to review within 72 hours Substack Help Center, reporting a profile (updated 30 Jan 2025). Blocking stops the account seeing your profile or Notes, mentioning you or subscribing Substack Help Center, blocking (updated 8 Dec 2024).

Substack's rules ban impersonation outright: "We don't allow impersonation, which includes posing as another person, brand, or organization" Substack Content Guidelines (updated 29 Sep 2026).

How do you lock down a Substack account?

Ten settings, most of them five minutes' work.

Turn on two-factor sign-in. Substack supports an authenticator app; you must set recovery questions first, under Settings, Security Substack Help Center, two-factor authentication (updated 20 Apr 2026).
Hide your reads under "Subscription Privacy", and turn off public likes Substack Help Center, profile (updated 2 Feb 2026).
Turn off the paid-subscriber badge if you don't want your paid reading shown Substack Help Center, profile (updated 2 Feb 2026).
Hide your subscriber count on your profile if you write Substack Help Center, subscriber count (updated 20 Feb 2025).
Keep your phone off receipts. Substack warns that support details "may be visible in payment statements, invoices, and receipts". It suggests a Google Voice number, and notes that "Stripe requires an address for receipts and invoices", so use a business address Substack Help Center, Stripe phone and email (updated 29 Jan 2026).
Use a separate email for your newsletter account Substack Help Center, writing anonymously (updated 20 Jan 2023). Writing under a pen name is allowed, but Stripe still needs your real details to pay you Substack Help Center, writing anonymously (updated 20 Jan 2023).
Limit messages. Set "Allow message requests from" to subscribers only or no one. Senders are not told when you reject a request Substack Help Center, direct messages (updated 10 Aug 2026).
Limit replies to your Substack email alias. By default anyone can email it; restrict it to subscribers under Settings, Community Substack Help Center, email alias (updated 9 Jun 2026).
Restrict comments per post to subscribers, paid subscribers or no one Substack Help Center, comments (updated 26 Jul 2026).
Don't give up a handle you care about. A released handle can be claimed by anyone Substack Help Center, handles (updated 2 Feb 2025), including an impersonator.

Then search your own handle and pen name with our username search to see what links back to you, and read our doxxing prevention guide if you write about contested topics.

Sources

Every source was read on 16 October 2026. URL patterns were tested on live publications that day. One publication we tried refused automated readers, and we did not work around it.

Frequently Asked Questions

Can people see which newsletters I subscribe to on Substack?

Yes, unless you hide them. Your profile shows the publications you read. In your profile settings, the Subscription Privacy section has a toggle for each one. Your follower and following lists cannot be hidden.

Is a checkmark on Substack a verified account?

No. Substack says its purple, orange and white checkmarks are bestseller badges earned through paid subscriptions, unlike verification badges on other platforms. A checkmark does not confirm who runs an account.

How do I find the substack.com address behind a custom domain?

Look up the domain's DNS: Substack custom domains use a CNAME to target.substack-custom-domains.com. Then view the page source; the original subdomain often appears inside social-preview image links, and the RSS feed at /feed reports Substack as its generator.

Can I stop Substack scanning my posts for AI?

You can disable AI detection on each post from the Publish page, and it has to be done post by post. One privacy writer reported in August 2026 that emailing [email protected] can switch scanning off for a whole account, but Substack's Help Center does not describe that option.

Was my data in the Substack breach?

Check your email address on Have I Been Pwned, which loaded 663.1k addresses from the Substack breach on 6 February 2026. Substack says email addresses, phone numbers and internal metadata were accessed in October 2025, but not passwords or card numbers.

Does Substack have two-factor authentication?

Yes. Substack supports two-factor sign-in with an authenticator app. You have to set up recovery questions first, then turn it on in the Security section of your account settings.

Next step

Check your own profile first. Open substack.com/@yourhandle in a private window, see what a stranger sees, then work through the ten lock-down settings above.