A single username links accounts across the internet. Sherlock checks 400+ platforms for username existence; Maigret checks 3,000+ sites and adds profile parsing (extracting personal data, linked accounts) and recursive search (auto-expanding to new usernames found on profiles). Cross-platform correlation connects discovered accounts via profile photos, bio text, activity timestamps, and social graph overlap. Ghost accounts (deleted profiles preserved in web archives) provide evidence of accounts destroyed to hide digital footprints. Always verify attributions — username reuse across unrelated people produces false positives.
Why Usernames Matter for OSINT
A username is often the single most consistent identifier across a person’s digital life. While email addresses, phone numbers, and real names may vary across platforms, many people reuse the same username — or predictable variations — across dozens of services. This creates a digital fingerprint that links accounts, builds identity graphs, and reveals behavioral patterns that no single platform exposes in isolation.
Username investigation is a core OSINT technique used in journalism (identifying sources and verifying claims), law enforcement (building suspect profiles), corporate security (insider threat detection), fraud investigation (connecting sockpuppet accounts), and competitive intelligence (tracking competitor activity). The technique is entirely passive when limited to querying public profiles and search indexes.
Username Enumeration Tools
Two tools dominate open-source username enumeration: Sherlock and Maigret. Sherlock (by the Sherlock Project, 200+ contributors) checks a given username across 400+ websites and platforms, outputting found profile URLs (Bellingcat Toolkit — Sherlock (v0.16.0, 2024)). It’s lightweight, CLI-based, and supports CSV/XLSX export, proxy/Tor routing, and site-specific filtering.
Maigret, a more powerful fork of Sherlock, checks over 3,000+ sites by default (top 500) with an expandable database. Its key advantage is profile page parsing: Maigret doesn’t just check if a username exists, it scrapes account pages to extract personal information, links to other profiles, and unique identifiers. It performs recursive search — when new usernames or IDs are found on a profile, Maigret automatically searches for those as well, building an expanding identity graph (Bellingcat Toolkit — Maigret). Reports can be generated in HTML, PDF, TXT, XMind mindmap, and JSON formats.
Tool Comparison
| Feature | Sherlock | Maigret | WhatsMyName | Namechk |
|---|---|---|---|---|
| Sites checked | 400+ | 3,000+ | ~600 | 90+ |
| Profile parsing | No (URL only) | Yes (extracts info) | No | No |
| Recursive search | No | Yes (auto-expands) | No | No |
| Report formats | TXT, CSV, XLSX | HTML, PDF, JSON, XMind | JSON | Web UI |
| API keys required | No | No | No | No |
| Web interface | Community only | Built-in (--web flag) | Web-based | Web-based |
| Tor/proxy | Yes | Yes | No | No |
Cross-Platform Identity Correlation
Username enumeration is just the first step. The real intelligence value comes from cross-platform correlation: connecting discovered accounts to build a comprehensive identity profile. Key correlation techniques include analyzing profile photos across platforms (reverse image search), comparing bio text and self-descriptions, mapping activity timestamps to establish timezone and behavior patterns, examining friend/follower networks for overlap, and checking writing style and language patterns.
Modern OSINT frameworks like osint-d2 combine username enumeration with AI-powered cognitive profiling, generating structured summaries with confidence levels. The tool integrates Sherlock for username scanning, performs email pivoting (extracting the local part of an email as a username candidate), and produces professional dossier exports suitable for incident response or executive briefings (GitHub — OSINT-D2).
Username Pattern Analysis
People create usernames following predictable patterns. Common structures include: firstname.lastname, firstnamelastname, first_last_YYYY, nickname_numbers, and gaming handles reused across professional platforms. Analyzing variations helps predict additional accounts. If an investigator finds jsmith92 on one platform, testing j.smith92, jsmith_92, johnsmith92, and jsmith1992 across other platforms often yields additional hits.
Cultural and generational patterns also emerge: younger users favor gaming-style handles with numbers and underscores, professionals tend toward name-based formats, and some users maintain entirely separate identities for personal, professional, and anonymous activity. The Sherlock {?} wildcard feature allows testing multiple variations in a single run.
Ghost Accounts and Deleted Profiles
A username that currently returns no results may still yield intelligence. The Wayback Machine archives social media profile pages, preserving content from accounts that have since been deleted, suspended, or renamed. Our Ghost Finder tool specifically targets this use case: searching archived snapshots of social media platforms for historical evidence of usernames that no longer exist on live platforms. This is critical for investigations involving accounts deleted to destroy evidence.
False Positives and Verification
Username enumeration tools check whether a URL responds with a profile page rather than a 404 error. This produces false positives when: a platform reserves usernames (returning a “this username is taken” page rather than an active profile), when unrelated people share the same username on different platforms, or when a platform’s error handling is inconsistent. Verification is essential: examine profile content, creation dates, activity patterns, and cross-references before attributing multiple accounts to the same individual.
Key Definitions
- Username Enumeration
- The systematic process of checking whether a specific username exists across multiple online platforms. Tools like Sherlock (400+ sites) and Maigret (3,000+ sites) automate this process, querying public profile URLs and analyzing HTTP responses.
- Cross-Platform Correlation
- Connecting accounts discovered across different platforms to a single identity by analyzing profile photos, bio text, activity patterns, writing style, and social graph overlap.
- Profile Parsing
- Extracting structured data from discovered profile pages, including names, locations, links to other profiles, unique platform identifiers, and biographical information. Maigret’s key differentiator over Sherlock.
- Recursive Search
- Automatically expanding a username investigation by searching for additional usernames and identifiers discovered during profile parsing. When Maigret finds a linked account with a different username, it searches for that username too.
- Sock Puppet
- A fake online identity created to deceive. Sock puppet detection is a key OSINT application of username enumeration: correlating creation patterns, activity times, and content overlap to link multiple accounts to a single operator.
- Ghost Account
- A social media account that has been deleted, suspended, or renamed but whose content persists in web archives, cached search results, or other historical data sources.
Sources
Bellingcat Toolkit — Sherlock (v0.16.0) (400+ sites, CLI options). Bellingcat Toolkit — Maigret (3,000+ sites, profile parsing, recursive search). PyPI — Maigret v0.5.0 (installation, features). GitHub — OSINT-D2 (AI-powered identity triangulation). GitHub — Awesome OSINT (comprehensive tool directory). Oshy Tech — What is Sherlock OSINT (2025) (installation guide, brand checking use case).
Frequently Asked Questions
What is username OSINT?
Searching for a username across hundreds of platforms to map a person’s digital footprint. Tools like Sherlock (400+ sites) and Maigret (3,000+ sites) automate this. Try our Username search for quick lookups.
What is the difference between Sherlock and Maigret?
Sherlock checks 400+ sites for username existence (URL output). Maigret checks 3,000+ sites plus parses profile pages for personal data, performs recursive search on discovered identifiers, and generates rich HTML/PDF/XMind reports with graph visualization.
How reliable are username enumeration results?
False positives occur from reserved usernames, name collisions, and inconsistent error handling. Always verify by examining profile content, creation dates, and cross-references. CAPTCHAs may cause incomplete results.
Can deleted social media accounts be found?
Often yes, via web archives. Our Ghost Finder searches archived social media snapshots for historical evidence of deleted profiles. The Wayback Machine preserves profile pages even after account deletion.