Mapping a Username Footprint Across Thousands of Sites: A Practical OSINT Workflow

Most people pick a handle once and keep it for years. A developer who registered it on a code host in 2014 will often have the same string on a forum, a chat server, a marketplace and a gaming profile by 2020. That habit is what makes username research productive, and it is also what makes it easy to get wrong: a long list of matches looks like a conclusion, when it is really a list of leads.

This article is a working method for mapping one handle across a few thousand sites. It covers why coverage matters, what the three main open datasets actually contain (we pulled their current files for the charts below), where manual and scripted checks break down, and how to verify a result before it goes into a report.

How the numbers were gathered. Site counts and category splits come from the public data files of WhatsMyName (wmn-data.json), Sherlock (data.json) and Maigret (data.json), downloaded from their GitHub repositories on November 4, 2026. We counted entries ourselves with a short script. The counts will drift as maintainers add and retire sites, so treat them as a dated snapshot. The research figures in the last section are quoted from the published paper, not recomputed.

Why Coverage Decides the Outcome

If you check only the fifty best-known social networks, you will find the accounts that everyone finds. The useful signal is usually elsewhere: a hobby forum where the person writes at length, a package registry that lists a contact address, a small marketplace where the same handle sells something. Those sites are rarely in a top-50 list, and a miss there is a false negative that nobody notices, because an empty result looks the same as a clean one.

The data shows how skewed the landscape is. Of the 7,818 active sites in Maigret’s list, 4,247 carry the forum tag, which is 54.3%. Add the discussion tag and the figure is 4,321. The popular, well-indexed networks are a small part of what a thorough check has to cover.

What the Three Datasets Cover

The three open projects answer different questions, so their numbers should not be compared as if they were one scale. WhatsMyName is a curated list that favours sites with predictable profile URLs. Sherlock is a lean list built for quick existence checks. Maigret is the largest, and it extends into forums and regional sites.

That 699 figure is worth pausing on. Roughly one in twelve Maigret entries is already disabled, and the maintainers are tracking only the ones they know about. A site list is a living thing; the longer the list, the more of it is quietly broken at any given moment.

Chart 1: What kinds of sites does WhatsMyName cover?

Social networks are the largest single group, but they make up under three in ten entries. Gaming, technology, hobby and coding sites together contribute another 31%. If your subject is a developer or a gamer, that second group is where a handle is most likely to be used consistently.

Chart 2: How popular are the sites in the long list?

Maigret stores a traffic rank for some of its sites. Only 849 of the 7,818 active entries have one, which means 6,969 (89.1%) are too small or too obscure to be ranked at all. Among the 849 that are ranked, the spread looks like this:

Only 13% of the ranked sites are in the top thousand. A handle search that stops at the big names ignores the other 87% of the ranked list, and everything in the unranked tail on top of that.

Why Doing It by Hand Breaks Down

Search operators

Typing an exact-match handle into a web search engine is a sensible first look. It finds pages that mention the handle in text. It does not find profiles that exist but are not indexed, and it cannot tell you about the many sites that keep profiles behind a login or a script-rendered page. It also returns every page where a common word happens to match.

Command-line scripts

Scripts solve the scale problem and create a different one. Each site definition has to decide what “this account exists” looks like, and that is harder than it sounds.

Chart 3: How reliable is a status code?

Two readings follow from this chart. In Sherlock, about a third of sites (32%) cannot be decided from the status code alone and rely on text or redirects. In WhatsMyName, the stricter dataset, 169 of 692 sites return the same status code for a real and a missing profile, so a check that looks only at the code would be wrong on roughly a quarter of the list. Pages that say “user not found” while still returning a normal 200 are the usual cause.

The practical consequence is simple. Every automated hit and every automated miss is a claim made by a rule that may be out of date.

A Working Method in Five Steps

1. Write the handle down exactly. Record the spelling, the reason for the search and the date. Run variants such as name_01, name.01 and name01 as separate searches, so every hit traces back to the spelling that produced it.
2. Run a broad pass. Use a large list first. In a scripted run, a command like maigret example_handle --tags coding restricts the run to a category, and sherlock example_handle --print-found prints only positive hits. In a browser tool, watch the checked-versus-total counter and note whether the run finished.
3. Triage by category. Sort hits into groups that matter for your question (code hosts, marketplaces, forums, social). Ten hits in one category tell you more than ten scattered ones.
4. Open every hit you intend to rely on. Check the account age, the language, the avatar, the bio and any links. A profile with a different language, time zone and interests from the others is probably a different person.
5. Rate each link. Label it confirmed (two independent signals agree), probable (one signal) or handle-only (the string matches and nothing else does). Only the first category goes in the conclusion.

Video walkthrough: a scripted run in practice

If you want to see a command-line run from install to results, this community walkthrough follows a Maigret setup and an investigation across its site list. It shows the tool’s output format, which is the part that is hardest to picture from documentation. Watch it as a demonstration of the interface, and apply the verification steps above to whatever it returns.

An Illustrative Case: Two Shops, One Handle

The following scenario is a constructed example, using reserved .example domains, to show how the steps fit together.

A brand-protection analyst is asked about a new marketplace shop called copperlane_outlet, which sells items that look like a client’s catalogue. The shop is eleven days old.

1. The broad pass on the exact handle returns two further marketplace shops and one social profile. The social profile is five years old, which is unusual for a shop created last month.
2. Opening the profile shows a bio linking to copperlane-deals.example and a logo that also appears on one of the shops.
3. A search for the variants copperlane.outlet and copperlaneoutlet returns nothing new. The analyst notes this as “checked, no further hits”, not as proof of absence.
4. A domain registration lookup for the linked site shows the same registrant organisation as the second shop’s contact page.

The rating at the end: the logo and the registrant link two of the shops (confirmed). The third shop matches only on the handle and a similar product photo (probable). Takedown requests go out for the first two; the third is queued for another look. The rating step is what stops a handle match from becoming a mistaken accusation.

What Research Says About Handle Reuse

The method rests on a behavioural claim that has been tested. In a 2011 paper at the Privacy Enhancing Technologies Symposium, Perito, Castelluccia, Kaafar and Manils studied more than 10 million usernames collected from eBay and Google Profiles. Their findings, as summarised in the abstract and results:

• Usernames chosen by different people are highly distinctive; for the datasets studied, the chance of two unrelated people picking the same long, unusual string was extremely low.
• People who use different handles on different services often make small edits (sarah becomes sarah2), which is why variant searches are worth running.
• A substantial share of profiles could be linked across services using the username alone. Press coverage of the paper reported that more than half of profiles in their test could be matched.

The same finding explains why generic handles are weak evidence: the paper’s model ties linkability to how unusual the string is. A match on alex means almost nothing. A match on a 14-character handle with an underscore and a year suffix means a great deal more, though still not everything.

Limits and Good Practice

• A hit is a lead about a string. It says that profile exists at that URL, not who runs it.
• A miss is not a negative. Sites change, block automated checks and sit behind logins. Record unchecked or failed sites as unchecked.
• Keep a log. Note the date, the exact spelling, the tool and the counts. Results change from one run to the next.
• Stay within your remit. Research only the handles you are authorised to look into, such as your own, your organisation’s or those named in a lawful investigation. Public availability does not remove data-protection obligations.

References

• WhatsMyName project and wmn-data.json (CC BY-SA 4.0), downloaded November 4, 2026
• Sherlock project and site data (MIT), downloaded November 4, 2026
• Maigret project and site data (MIT), downloaded November 4, 2026
• Perito, Castelluccia, Kaafar, Manils: How Unique and Traceable Are Usernames? (PETS 2011)
• Maigret GitHub Install Setup Guide (YouTube)
• Holehe vs Sherlock vs Maigret vs WhatsMyName and Username OSINT Search on this site