Data sources

A data source is the external data source a Module queries. When you run a search, UserSearch sends your input to one or more data sources and returns what they hold. This page catalogues every named data source that appears across the intelligence Search types at v2.0.20, and explains how data sources relate to Module, OneScan, Credits, and Match Accuracy.

Keep three terms distinct:

• data source — the external data holder (for example, Shodan or PIPL).
• Module — the UserSearch card you click. A single-source Module often borrows the data source’s name but is a different object.
• OneScan — a UserSearch Module that fans out across several data sources at once. It is not itself a data source.

AI Agent Email surface showing multiple named data sources

What is verified on this page

The following are read directly from the interface and are reliable:

• Each data source’s name (and the different spellings the UI shows for it).
• The Modules that reference each data source.
• The Search types each data source appears in.

Caution

Every note about what a data source does or how it collects data — the “data class” and “collection posture” descriptions in the tables below — is inferred from general OSINT domain knowledge and has not yet been confirmed by the product. Treat those columns as draft. Do not rely on them as authoritative statements of a data source’s behaviour, coverage, or data-collection method.

Confirmed facts about data sources

These points are confirmed (per Lee, 2026-07-08) and take precedence over any inferred note below.

• Match Accuracy is set by the data source. Any accuracy or confidence figure shown against a result is the data source’s own figure. UserSearch does not compute it.
• Found vs Enriched. Found means the identifier is located on a site (an account exists there). Enriched means UserSearch holds further metadata on that account, such as possible names or linked emails.
• Cost falls into three tiers.
  • Free — some Modules cost no Credits.
  • Fixed — single-source Search type Modules have a fixed price (for example, Vehicle is $5.00).
  • Dynamic — a OneScan search costs the sum of all data sources left selected in the Choose Data Source modal, so its price is a range that moves as you toggle data sources on and off.

single-source Search types

Two Search types are backed end to end by a single data source:

Search type	data source	Coverage
Cyber Intelligence	Shodan	All 12 Modules
Wireless Device	Wigle	All 6 Modules

Chat Messaging is effectively single-source (Telegram via TelemetryApp), pending confirmation of four un-labelled Telegram Modules.

Cyber Intelligence Search type, Shodan-backed modules

data source registry

data source names, UI spellings, Modules, and Search types in the tables below are observed and reliable. The Data class and Collection posture columns are inferred and unconfirmed (see the caution above).

Identity, social & people enrichment

data source	UI spellings seen	Appears in (Search type · Module)	Data class (inferred)	Collection posture (inferred)
UserSearch (native)	UserSearch	Username (Username Search, 3000+ sites); Email (Reverse-Email / Email Search, Domain Ownership)	social/identity; domain ownership	passive / OSINT (own crawl)
PIPL	Pipl - Social, Pipl - Business, PIPL	Username; Email; Phone; People (Pipl-Social + Pipl-Business); Vehicle (Vehicle Owner)	people/PII; social + business identity	passive / OSINT
OSINT.Industries	OsintIndustries, Osintindustries, OSINT.INDUSTRIES	Username; Email; Phone; People	social/identity enrichment	passive / OSINT
PredictaSearch	Predicta, PredictaSearch	Username; Email; Phone; People	social/identity enrichment	passive / OSINT
EPIEOS	Epieos, EPIEOS	Email; Phone	social/identity enrichment	passive / OSINT
Gravatar	Gravatar	Email (Email-To-Name)	social/identity (name + avatar)	passive / OSINT (public profile API)
ProtonMail	ProtonMail	Email (ProtonMail Analyse)	email metadata	passive probe (existence + metadata)

Caution

The ProtonMail Module’s ability to locate a creation date and sometimes a forwarding email is drawn from AI Agent copy and is not yet confirmed. The Social vs Business split for PIPL, and whether Vehicle Owner uses the same PIPL feed, are also unconfirmed.

Breach, leak & scam corpora

data source	UI spellings seen	Appears in (Search type · Module)	Data class (inferred)	Collection posture (inferred)
IntelX (Intelligence X)	IntelX	Public Leaks (default Module); Email (AI Agent Public Leaks)	breach-credential; leaked docs	breach corpus
Dehashed	Dehashed	Public Leaks; Email (AI Agent)	breach-credential	breach corpus
HaveIBeenPwned	HaveIBeenPwned, HavelBeenPwned	Public Leaks (email breach check); Email (AI Agent)	breach-credential (email → breach list)	breach corpus (passive lookup)
Global Scam Database	ScamSearch, Global Scam Database	Email (Scam Database)	reputation / scam reports	passive / OSINT (community scam DB)

Caution

The interface misspells HaveIBeenPwned as HavelBeenPwned in at least one place (SS-27). Whether the ScamSearch Module label and the Global Scam Database data source name are the same entity is not yet confirmed. The claim that breach data sources never return full passwords/credentials is drawn from AI Agent copy and is unconfirmed.

Threat & network reputation

data source	UI spellings seen	Appears in (Search type · Module)	Data class (inferred)	Collection posture (inferred)
HudsonRock	HudsonRock	Threat (Computer/IP Threat, Email Threat, Domain Threat); Email (AI Agent Email Threat)	infostealer / compromised-device threat	breach corpus (infostealer logs)
SpamHaus	SpamHaus	Threat (IP Reputation, Domain Reputation, Malware URLs)	reputation / blocklist	passive / OSINT (blocklist)
Shodan	Shodan	Cyber Intelligence — all 12 Modules	infrastructure / network	active probe (internet-wide scanner)
Wigle (WiGLE)	Wigle	Wireless Device — all 6 Modules	geolocation (wardriving)	passive / OSINT (crowdsourced)

Caution

Whether Shodan queries hit a pre-built index rather than scanning live at request time is inferred. The Wireless Device interface warns that a Wigle search “can take up to 60 seconds.”

Corporate, legal-entity & sanctions

data source	UI spellings seen	Appears in (Search type · Module)	Data class (inferred)	Collection posture (inferred)
OpenCorporates	OpenCorporates	Corporate (Company Search, Director Search, Address Enquiry, Trademark Search)	corporate / registry	registry / official (aggregated)
CompaniesHouse (UK)	CompaniesHouse - UK	Corporate (Company Search UK, Officer Search UK)	corporate / registry (UK)	registry / official
GLEIF	GLEIF	Corporate (LEI Search)	corporate / registry (LEI)	registry / official
SEC (USA)	SEC - USA	Corporate (SEC Full-Text Search)	corporate / regulatory (US filings)	registry / official
OpenSanctions	OpenSanctions	Corporate (Person Sanctions, Company Sanctions)	sanctions / watchlist	registry / official (consolidated)

Court & judicial records

data source	UI spellings seen	Appears in (Search type · Module)	Data class (inferred)	Collection posture (inferred)
CourtListener (USA)	USA, CourtListener	Court Records (US CourtListener)	court / judicial (US)	passive / OSINT (aggregated)
UK National Archives	UK, National Archives	Court Records (UK National Archives)	court / judicial (UK)	registry / official
OCCRP Aleph	Russia, OCCRP Aleph	Court Records (OCCRP Aleph)	court / investigative data	passive / OSINT (aggregated)
Canada A2AJ	Canada, A2AJ	Court Records (Canada A2AJ)	court / judicial (Canada)	passive / OSINT
France Judilibre	France, Judilibre	Court Records (France Judilibre)	court / judicial (France)	registry / official

Caution

Whether the “Russia” label on OCCRP Aleph refers to the jurisdiction of the data rather than the data source’s location is not yet confirmed. The full formal names of Canada A2AJ and France Judilibre are unconfirmed.

Image, face & geolocation

data source	UI spellings seen	Appears in (Search type · Module)	Data class (inferred)	Collection posture (inferred)
FaceCheck.id	FaceCheck.id	Picture (Face Search)	image / biometric (face)	passive / OSINT (face index)
CamGirlFinder	CamGirlFinder	Picture (Face Search (18+))	image / biometric (adult)	passive / OSINT
Picarta	Picarta	Picture (Image Geo-location)	geolocation (image)	passive (AI geo-inference)
FindPicLocation	FindPicLocation	Picture (Image Geo-location, 2nd)	geolocation (image)	passive (AI geo-inference)
TinEye	Tineye, TinEye	Picture (Image reverse search)	image (reverse)	passive / OSINT (crawl index)
Google Lens	Google Lens	Picture (Image reverse search)	image (reverse / visual)	passive / OSINT

Caution

The Picture Search type also contains a Fake Image Check Module (“Detect manipulated images”). It names no data source, and its backing engine has not yet been captured.

Product, market & Google/Apple

data source	UI spellings seen	Appears in (Search type · Module)	Data class (inferred)	Collection posture (inferred)
Google Trends	Google Trends	Product (Product Trends, Trending Now)	market / trends	passive / OSINT
Google Scholar	Google Scholar	Product (Scholar Search)	academic publications	passive / OSINT
Google Calendar	Google Calendar	Product (Events)	events	passive / OSINT
Google Patents	Google Patents	Product (Patents)	patent records	passive / OSINT
Google Ads	Google Ads	Product (Ad Creatives)	ad creatives	passive / OSINT
Apple	Apple	Product (Apple Apps)	app-store listings	passive / OSINT

Caution

Whether the six Google-branded Modules and the Apple App Store Module are direct API integrations or scraped is not yet confirmed.

Messaging & forums

data source	UI spellings seen	Appears in (Search type · Module)	Data class (inferred)	Collection posture (inferred)
TelemetryApp (Telegram)	TelemetryApp	Chat Messaging — five Telegram Modules (Chat Messages, Channel Full Member List, User Lookup, Channel Lookup, User Historic Pictures)	messaging (Telegram)	passive / OSINT (indexed public channels)
Reddit / Intel AI	Intel AI	Public Forums — Reddit User (AI-powered), plus Reddit User Profile, Post History, Comment History, Activity Timeline	forum / behavioural	passive / OSINT (public Reddit)
GitHub	Github	Username (GitHub Search)	code / activity	passive / OSINT (public API)
InternetArchive (Wayback)	InternetArchive	Username (Twitter History, Twitter Posts); Website Forensics (Website Change History)	historical web snapshots	passive / OSINT (archive)

Caution

Only the Telegram Chat Messages Module explicitly shows “(Data: TelemetryApp)”; whether the other four Telegram Modules share this data source is unconfirmed. Whether Intel AI is a distinct third-party data source or UserSearch’s own AI layer over Reddit’s public API is not yet confirmed — the other four Reddit Modules name no data source.

Modules with no captured data source

These Modules exist but do not name a data source in the captured interface. Their backing data source has not yet been captured and is for Lee to confirm.

• Phone › Background Check (US) — “Comprehensive US-based background check.”
• Vehicle › Vehicle Lookup (UK Only, Enriched) and Vehicle Lookup (US Only, Enriched) — the UK Module returns make/model/MOT/tax. The Vehicle Owner Modules use PIPL; these enriched-lookup Modules do not name a data source.
• Website Forensics WHOIS-based Modules — Website Domain Ownership (by Domain) / (by Email), 3rd Party Website Lookup, and Search by Favicon.
• Cryptocurrency › Address Lookup and Websites by Address — accept EVM / 0x wallet addresses and return transaction history, balance, and metadata.
• Picture › Fake Image Check — see the image table caution above.

Vehicle Search type, Owner vs enriched-lookup modules

OneScan is a Module, not a data source

OneScan is a UserSearch Module, not a third-party data source. It appears (marked RECOMMENDED) in most Search types, including Username, Email, Phone, People, Picture, Public Leaks, and Court Records.

• What it does: fans out one input across several underlying data sources at once and merges the results. The results table’s Data Source column then shows which data source each row came from.
• Cost: a OneScan search costs the sum of all data sources left selected in the Choose Data Source modal, so its displayed price is a dynamic range that moves as you toggle data sources on and off (per Lee, 2026-07-08).

Caution

Exactly which data sources OneScan defaults to in each Search type is not yet confirmed.

Spelling and casing

The interface is internally inconsistent about data source names. You may see OsintIndustries and OSINT.INDUSTRIES; Predicta and PredictaSearch; Epieos and EPIEOS; Tineye and TinEye; a ScamSearch Module label against a Global Scam Database data source; and the outright typo HavelBeenPwned. Canonical display names are still to be finalised.

Verified against UserSearch v2.0.20