Username checks for security teams and investigators

Threat actors reuse handles. So do employees who post more about work than they should. For security teams, a username seen in a phishing kit, a leak site or a support ticket is a lead worth running. This page covers how a username search across 3,166 sites fits into authorized investigation and threat intelligence work.

Free, no sign-up. Up to five usernames, 3,166 sites. The username is not stored or logged.

Where usernames show up in security work

Handles appear in places security teams already watch: the author field of a malicious package, a seller name on a forum, the Telegram contact in a scam message, a commit in a leaked repository. Someone who picks a handle tends to keep it, so the same string often leads to older accounts with more context, such as an earlier project, a language preference or a time zone.

The same search works for defense. Running your organization's brand handles and executives' public usernames (with their agreement) shows where impersonators could pose as you, and where staff accounts reveal more than they should.

How the tool supports an investigation

Paste a handle or a profile URL and the tool extracts the username and checks it on 3,166 sites, filterable by category such as coding, finance or social. Each site comes back as Found, Not found, Blocked or Unknown. Treat every one of them as a lead to verify, not a verdict. For Found results it pulls public profile details where the site exposes them, which speeds up the first pass of deciding which hits are worth opening.

You can run up to five usernames in one search, enough for a seed and its common variants. Results export as JSON or CSV with the site, status and profile URL, so they drop into case notes or a ticket. The username is sent to our server only to run the check and is not stored or logged. For the full methodology, see the OSINT username search guide.

Step by step

Confirm scope and authorization. Make sure the work is inside an approved scope, such as an incident, a brand protection program or a contracted engagement, and note who approved it.
Record the seed handle and its source. Write down where the username came from and when. Every later finding inherits the confidence of that seed.
Search the seed and variants. Enter the handle plus up to four variants and run the search. Filter to categories that match the case: coding for package abuse, finance or shopping for fraud.
Verify before you pivot. Open each Found profile and look for independent links to the seed: the same avatar, cross-links, matching writing or timestamps. A shared string alone is not attribution.
Export and document. Export JSON or CSV, add your own timestamps and screenshots, and store them with the case. Profiles change or vanish, so capture what matters right away.

Frequently asked questions

Does a Found result attribute an account to a threat actor?

No. It only shows that a public profile answered for the exact handle. Attribution needs independent corroboration such as shared infrastructure, cross-links or consistent behavior.

Does the tool contact the accounts it finds?

No. It requests public profile pages or public endpoints for the handle. It does not log in, message or follow anyone.

Can I export results for a case file?

Yes. JSON and CSV exports include the site, status and profile URL for each check. Add your own timestamps when you file them.

Is the searched handle logged on your side?

No. It is sent to our server only to run the check and is not stored or logged.

Can I search email addresses or phone numbers?

Not yet. Those checks are coming soon. Today the tool searches usernames only.

Related tools and guides

WhatsMyName Apps is an independent tool, not affiliated with or endorsed by the WhatsMyName project, Sherlock, Maigret or any site it checks. Results are leads to verify.