Username OSINT: How to Find Accounts From a Username

Why a handle is such a good starting point

Email addresses are usually private and phone numbers are rarely published. Usernames are the opposite: they sit in profile URLs, mentions, commit histories and forum signatures. And because a good handle takes effort to claim, many people pick one once and carry it from site to site.

That habit is what makes username research quick. Security teams use it to see what an attacker alias left behind, trust and safety teams use it to link abusive accounts, journalists use it to check a source, and plenty of people run their own old handles to see what is still out there. The technique is simple. Doing it accurately is where the work is.

How enumeration works

Most platforms put the username in a predictable address, such as https://example-forum.com/u/jdoe-dev. Enumeration means requesting that address (or an equivalent API endpoint) on many sites and deciding, site by site, whether an account exists. Sites answer that question in different ways, and each way needs its own rule:

Open source tools such as Sherlock and Maigret encode these rules for hundreds of sites, and Maigret also parses profile pages for extra identifiers. They are a good way to learn the technique. Whatever you use, the result is only as good as the detection rule behind each site.

Why you get false positives, and how to cut them

Sites change their markup, add bot protection or start serving the same page to everyone. When that happens, a rule that worked last month reports every username as found. A list of 80 hits can look impressive and still be mostly noise.

The usual causes:

• A login wall or cookie banner that answers 200 for any address.
• Rate limiting or a CAPTCHA served in place of the profile.
• Reserved or squatted names: the account exists, but it belongs to the platform or to a stranger.
• Very short or common handles such as alex or admin, which exist almost everywhere.

The fix is a control check. Search a string nobody would register, then see which sites claim to know it.

# 1. search your real handle
jdoe-dev          -> 41 hits
# 2. search a random control string
qz7xk2v9_nobody   -> 6 hits
# those 6 sites say "found" for anything: drop them from step 1

Then open every remaining hit and confirm the page loads with real user content. The diagram shows the order we work in.

Searching handle variations

People rarely get the same handle everywhere. If jdoe was taken, they may have registered jdoe-dev, j.doe, jdoe92 or thejdoe. Build a short, deliberate list instead of hundreds of random permutations:

• Separators: none, underscore, dot and hyphen. Some sites do not allow dots or hyphens, so a miss there means little.
• Suffixes you have already seen: if one profile uses -dev or a number, try the same suffix elsewhere.
• Prefixes: the, real, its and iam are common when the base name is taken.
• The local part of an email: if you know jane.doe@example.com, jane.doe is a strong candidate. Our email OSINT guide covers the other direction.

Every variation multiplies the work of verifying hits, so start with the ones you have evidence for. Profiles often name each other in their bios, which tells you exactly which variant to search next.

Proving it is the same person

This is the step that separates research from guesswork. Two accounts called jdoe-dev are only connected if you can point to evidence. Look for overlapping attributes and be honest about how strong each one is:

Our rule is two independent signals before accounts count as linked, with the signals written down next to the link. "Independent" matters: a display name derived from the handle is the same signal twice. If you are building a report, keep a confidence level on each link so a reader can tell solid connections from plausible ones. The guide to fake profiles and sockpuppets covers the opposite problem, accounts that pretend to be connected or to be someone else.

A matching handle is where the work starts, not where it ends.

What to pull from a verified profile

Once a hit is verified, the profile is the next source. Record what the site shows publicly:

• Display name, bio, location and website link
• The avatar image, saved so you can compare it across sites
• The account creation date, if shown, to see how long the handle has been in use
• Linked accounts and contact details the owner chose to publish

Some platforms expose far more through public APIs. A GitHub profile can show organisations, repositories and commit metadata; the GitHub OSINT guide shows what that contains and how to read it responsibly.

The same workflow in TraceFind

1. Run the username search

   Enter jdoe-dev. TraceFind checks about 1,000 of the most-used sites. Because the site list is health-checked daily, sites whose detection has broken drop out instead of reporting false hits.

2. Read the cards, not just the list

   Where a site exposes them, the result card shows name, bio and avatar next to the hit, which makes the avatar and bio comparison from the table above quick.

   

3. Let the platform investigation run

   For hits on GitHub, Discord, TikTok, Reddit, Telegram, Strava, Bluesky, Mastodon, Steam, Keybase, Hacker News, YouTube and GitLab, a deeper investigation runs automatically and pulls the account's public details. The Mastodon card above shows one.

4. Pivot on what you found

   If a profile lists an email address, run an email search to see which of 296 sites have an account registered to it and whether it appears in breach records.

5. Put the verified links on the canvas

   Add the accounts to the investigation canvas, link them to the person and note the evidence for each link. The investigation workflow article walks through that step.

Legal and ethical limits

The technique works in reverse too. If you are checking your own exposure, search your old handles, then delete or lock down the accounts you no longer use. Shrinking your digital footprint has the full routine.

Frequently asked questions