Advanced Username OSINT: Mapping Accounts and Campaigns by Handle

Disclaimer: This article is for education and for lawful, authorised professional research. Use these methods only where you have a legitimate purpose and a lawful basis, and follow the laws and platform terms that apply to you, including data protection law such as the UK GDPR and EU GDPR. See our Terms of Service.

Online, a username is more than a label. It is a naming pattern that organisations, sellers, projects and campaigns reuse across platforms for years. A brand's handle on X usually matches its GitHub organisation, its YouTube channel and its marketplace store. For OSINT analysts, that consistency is extremely useful.

While a company's email addresses change with staff and suppliers, a handle like brightforge_labs often persists from an early forum account in 2015 to an app store listing in 2025. By following this single string of text carefully, you can map the accounts an organisation runs, connect the pieces of a coordinated campaign and spot the lookalikes that borrow a brand's name.

This guide goes deeper into username OSINT. We move beyond simple Google searches to advanced enumeration, pattern analysis and correlation, and show how to use UserSearch to check thousands of sites and turn a single handle into a clear, sourced report.

TL;DR

• Handle reuse is predictable: organisations and campaigns recycle handles or close variations across platforms, creating a pattern you can map.
• Manual search is slow and noisy: search operators and single-site checks miss niche platforms and take hours to verify.
• Pivoting builds the picture: an old forum account often shows an earlier trading name, a website or a contact address that connects the rest.
• UserSearch speeds up the work: Username Intelligence checks thousands of sites, OneScan merges results with their sources, and Cases keep your findings together.

What Is Username OSINT?

Username OSINT (open-source intelligence) is the practice of researching a specific handle to understand where it is used in public and who operates it, usually an organisation, a seller or a campaign. It relies on handle reuse: organisations want to be recognisable, so they rarely invent a new name for every service.

The process has three layers:

1. Enumeration: checking whether the handle exists on hundreds of platforms (for example, finding example_handle on X, GitHub and a marketplace).
2. Correlation: confirming that the example_handle on GitHub is the same operator as the one on the marketplace, using bios, logos, linked websites and timing.
3. Pivoting: using unique details found on one account (a website, a support address, an earlier trading name) to start new searches.

For wider methodology on verification, the OSINTCurious project offers good resources. We return to their core point throughout: every link between accounts needs evidence, not just a matching name.

Why do organisations reuse names? Recognition and convenience. Most businesses have a "core" handle (the brand name) and a few predictable variants (with "official", "hq", "uk" or a year). Once you know the core stem, you can predict the handle on almost any platform.

Why It Matters: Connecting the Dots

Username research often moves a stalled case forward. An operator might keep a new campaign's accounts tidy but reuse an older handle, logo or bio phrase that connects them to an earlier operation. Connecting those accounts is how researchers show that apparently independent voices are one coordinated effort.

Consider EU DisinfoLab's Doppelganger research. It documented a cross-platform operation that combined lookalike copies of real news sites with amplification accounts on social networks. Much of that work rested on open-source methods: matching domains, designs and accounts until the network was clear. Journalists and research professionals use the same approach at a smaller scale every day.

For corporate teams, username research is valuable in supplier and partner due diligence. A supplier might look perfect in its pitch deck, but its public accounts may show a different trading name, a recent rebrand or a history of customer complaints. Understanding how an organisation presents itself across platforms tells you a lot about how it operates.

Security teams use the same patterns defensively. If you know a lookalike campaign uses variants of your brand name, you can reserve those handles on your own platforms and report copycat accounts to the platforms that host them. For another angle on messaging platforms, see our guide to Telegram channel research.

The Manual Method: Researching by Hand

Before automating, it helps to understand the manual process. If you had to research a handle with no budget, here is how you would do it.

1. Search Engine Operators

Start by asking search engines to look for the handle in URLs and page titles. This finds account pages on sites that standard tools do not cover.

The URL query:

inurl:example_handle

The title query:

intitle:example_handle

The broad sweep:

"example_handle" -site:x.com -site:instagram.com

(This removes the large platforms to show smaller, niche forum results.)

You can also focus on specific platforms with site-specific queries. For example, to check code repositories and project boards:

site:github.com "example_handle"
site:trello.com "example_handle"
site:pastebin.com "example_handle"

Finding a handle on Trello or Pastebin sometimes turns up public project boards or published configuration notes, which can point to an organisation's website or support address.

2. CLI Enumeration Tools (Using Maigret)

A standard tool for manual username checks is Maigret, a fork of Sherlock. It runs from the command line and checks a handle against thousands of sites, extracting public account details where possible. It needs no API key.

Running a check:

# Install Maigret (PDF reports need the optional extra)
pip3 install 'maigret[pdf]'

# Check the handle and write HTML and PDF reports
maigret example_handle --html --pdf

The output:
Maigret produces a long list of URLs. The --html and --pdf flags write report files you can keep with your case notes. Your job is then to visit each result and check it. This is the bottleneck: finding 50 accounts is easy; verifying them takes hours.

Watch for false positives. Maigret checks whether a page exists. Some sites return a "200 OK" status code even for a missing account (a "soft 404"), which can mislead the tool. Always verify the important results by hand.

3. Archived Account Pages

Accounts are renamed, emptied and deleted. The Wayback Machine keeps earlier versions of many public account pages. Paste the account URL into it and compare the snapshots.

# List archived snapshots of an account page (CDX API, no key needed)
curl -s "https://web.archive.org/cdx/search/cdx?url=github.com/example_handle&output=json&limit=20"

url is the page to look up, output=json returns structured results, and limit caps the number of rows. Each row includes a timestamp you can open in the Wayback Machine. Older snapshots often show an earlier company name, website link or contact address that the live page no longer carries.

4. URL Guessing and Curl Scripts

For sites Maigret does not cover, try the URL directly. Most sites follow predictable patterns:

• instagram.com/example_handle
• medium.com/@example_handle
• steamcommunity.com/id/example_handle

If you get a 404, the account probably does not exist. If it loads, check the content. You can automate this with a simple bash loop if you have a list of domains:

handle="example_handle"
for domain in "github.com" "x.com" "instagram.com"; do
  status=$(curl -o /dev/null --silent --head --write-out '%{http_code}' "https://$domain/$handle")
  if [ "$status" -eq 200 ]; then
    echo "Found on $domain"
  fi
done

--head requests headers only, and --write-out '%{http_code}' prints the status code. The script is basic but useful for quick checks on sites that larger tools miss. Keep the list short and the pace slow to respect each site's rate limits.

The Pivot: Scaling with UserSearch

Manual enumeration works but is exhausting. Verifying 50 links, saving screenshots and cross-checking bios by hand does not scale. This is where UserSearch helps. One account gives you 100+ third-party data sources, and Username Intelligence returns avatars, bios and timestamps with the source for each result. OneScan runs one handle across the sources you select and shows the Credit cost before you run it.

Scenario 1: The Unauthorised Reseller Network

The Context: The brand team at Tidewater Audio, a fictional headphone maker, finds heavily discounted stock sold by a marketplace store called SoundDeals_88. It wants to know whether this is one seller or several.

The Manual Problem: Google shows little beyond the store page. The team suspects the handle has been used before.

The UserSearch Workflow:

1. Broad username search: the analyst runs SoundDeals_88 through Username Intelligence. It returns a match on an older audio enthusiast forum and a second marketplace.
2. The hit: the forum account's signature links to a trading website for a company called Northlane Electronics.
3. Correlation: Domain Intelligence on the trading website shows the same favicon and hosting as two other marketplace stores selling Tidewater products.
4. The pivot: Corporate Intelligence confirms Northlane Electronics is a registered company, which gives the brand team a named business to contact.

The Outcome: Tidewater has documented links between three stores and one registered company, each with its source. Its legal team writes to the company and files reports with the marketplaces.

Scenario 2: The Coordinated Review Campaign

The Context: Fenmoor Hotels, a fictional hotel group, sees a sudden run of one-star reviews from new accounts on a review platform and on Reddit. One handle is TravelTruth2024.

The UserSearch Workflow:

1. Public Forums (Reddit): the analyst reviews the Reddit account's public posts. It has no history beyond the reviews, but posts in the same subreddit as several other new accounts.
2. Pattern analysis: the "2024" looks like a suffix. The analyst runs TravelTruth, TravelTruth2023 and TravelTruth2024 together using bulk search.
3. The match: an older TravelTruth account on a travel forum links to a marketing agency website that advertises "reputation services".
4. Image check: a Picture search shows that several of the new review accounts use stock photos also found on the agency's website.

The Outcome: Fenmoor has evidence that the reviews form a coordinated campaign linked to one agency. It reports the accounts to the platforms under their policies on inauthentic reviews and keeps the evidence in a Case. The work stays focused on the accounts and the agency, not on any individual reviewer.

Scenario 3: The Deleted Account and the Archive

The Context: A journalist is researching a company that went quiet after complaints. Its X account @QuickShipGlobal is now blank.

The Workflow: The journalist puts the account URL into the Wayback Machine. There is no recent snapshot, but there is one from 2023.

The Result: the snapshot shows an older bio: "Fast freight from Rotterdam | a Harbourline Group company". Even though the live account is empty, the archived bio gives two new leads: a location for the business and a parent company. The journalist runs the exact bio text as a quoted search to find the company's older website, then checks the parent company in Corporate Intelligence. Replies from other users that quote the account's old posts help reconstruct what it said publicly.

Scenario 4: The Supplier's Public Code

The Context: A security team is carrying out due diligence on a new software supplier, Orrin Data Ltd, as part of its supply chain security checks.

The Workflow: the team takes the supplier's handle, orrindata, from its website and runs it through Username Intelligence via OneScan.

The Finding: it finds a public GitHub organisation with the same handle. One repository of "deployment scripts" contains what look like live API keys for a cloud service, committed two years ago and still public.

The Outcome: the team has found a significant security issue in the supplier's public footprint that a questionnaire did not reveal. It tells the supplier privately so the keys can be revoked, and records the issue in its risk assessment. The team does not test the keys; it reports them.

Advanced Strategies: Pattern Analysis

Operators who want several accounts often vary their handles, but they fall into predictable patterns. Here is how to spot them.

1. Suffix and Prefix Rotation

If ExampleBrand is taken, organisations predictably add:

• Years: ExampleBrand90, ExampleBrand2024
• Regions: ExampleBrandUK, ExampleBrandNY
• Status words: RealExampleBrand, OfficialExampleBrand, ExampleBrandHQ

When searching, do not just run the exact handle. Run the variations. With bulk search you can put up to five variations through one Module in a single batch.

2. Character Substitution

Look for standard substitutions. If CyberPunk is the handle, also check Cyb3rPunk, Cyber_Punk and Cyber.Punk. Lookalike accounts often swap an "o" for a "0" or add an underscore to get as close as possible to an official brand name. Write the variants down before you search so your coverage is consistent and repeatable.

3. Cross-Platform Bio Matching

Sometimes the username changes entirely, but the bio stays the same. If an account uses the phrase "Handmade in Cornwall since 2011" on X, search for the phrase in quotes ("handmade in cornwall since 2011"). You will often find the business's Instagram or blog under a completely different handle.

Organisations become attached to their taglines. Even if a shop changes from OldHandle to NewHandle, it may keep "Est. 1985 | Family-run". Searching for that exact string is one of the most effective ways to connect accounts after a rename.

4. Shared Links and Contact Details

Look at what each account points to: the website in the bio, a link-in-bio page, a support email or a WhatsApp business number. Two accounts with different handles that link to the same checkout page or the same support address are very likely run by the same operator. Run those shared details through Domain Intelligence, Email Intelligence or Phone Intelligence to extend the map. This works best with distinctive details; a generic link to a large marketplace will produce too many false positives.

5. Filtering False Positives: The "Common Name" Trap

One of the biggest problems in username OSINT is the common handle. If the handle is Phoenix or MatrixNeo, you will find thousands of results, most irrelevant. To filter the noise, use secondary identifiers:

• Account age: if the company was founded in 2019, a forum account from 2004 is probably someone else.
• Topic clustering: if the organisation makes audio equipment, a knitting forum account with the same handle is likely a false positive.
• Language and region: if the business trades only in Germany, an account on a Chinese-language network deserves more checking before you connect it.

In UserSearch, grouping results by platform category (code, marketplaces, forums, social) helps you focus on the sites that match the organisation's line of business.

6. Avatar Hashing and Reverse Image Pivoting

Just as organisations reuse bios, they reuse logos and avatars. If you find a handle on a forum but the account page shows little, save the avatar. Run it through TinEye or a UserSearch Picture search.

You might find that StoreX on a forum uses the same unusual logo as StoreY on a marketplace. An identical file suggests a link, even if the names are completely different. For extra certainty, compare file hashes:

# Identical files give identical hashes
sha256sum avatar_forum.png avatar_marketplace.png

sha256sum prints a fingerprint for each file. Matching fingerprints mean the files are byte-for-byte identical; different fingerprints can still be the same picture resized, so use reverse image search as well.

7. Time-Zone Analysis

If you have found a cluster of accounts (for example Reddit, X and a forum) but are not sure they share an operator, look at posting times. If AccountA posts consistently between 09:00 and 17:00 UTC and AccountB between 09:00 and 17:00 EST (UTC-5), they are probably run from different places. This "temporal fingerprint" is hard to fake over a long period, which makes it useful supporting evidence in campaign research.

Legal and Ethical Guardrails

Connecting accounts is powerful. Use it for a clear, lawful purpose.

• Purpose first: this work supports due diligence, brand protection, security research and journalism. Decide your purpose before you search and collect only what it needs.
• Verification is key: the same handle on two platforms does not prove the same operator. Always confirm with a second data point, such as a shared website, logo or contact detail, before you connect them.
• Report through proper channels: if you find evidence of wrongdoing, pass your sourced report to the platform, the organisation concerned or the authorities rather than contacting account holders yourself.

If your research uncovers a security issue, as in Scenario 4, follow responsible disclosure. The NCSC's vulnerability reporting guidance and the EFF's vulnerability reporting FAQ are useful starting points.

The Handle Is the Key

A username is a thread. Follow it carefully and you can see how an organisation or a campaign presents itself across the web. What starts as a meaningless string of characters can lead to trading names, websites and connected accounts, if you know how to look and how to check.

Manual tools give you a glimpse. UserSearch gives you the fuller picture: Username Intelligence across thousands of sites, OneScan with source attribution, bulk search for variations, and Cases to keep your evidence together. That frees your time for the real work: analysis and verification.

Ready to map your first set of accounts?
Stop guessing. Start researching with UserSearch.