Social Media & Username Analysis

Learning Objectives

• After this, students can read a social profile analytically — separating stated facts, inferred facts, and background details.
• After this, students can perform “pattern-of-life” analysis and explain why it is both powerful and ethically sensitive.
• After this, students can enumerate a username across hundreds of sites using Sherlock, WhatsMyName, and Maigret.
• After this, students can describe how an email address becomes a pivot point to other accounts, at a conceptual level.

The Two Jobs of This Technique

Social-media and username analysis does two things. First, it characterizes a known person or account: what do they do, who do they know, where are they, what do they use? Second, it pivots: it turns one identifier (a username, an email, a photo) into others, expanding a single lead into a web of linked accounts. Both jobs run on the same raw material — the trail people leave across platforms — and both are governed by the same rules from Module 2 and the OPSEC practices in Module 8.

The specific platforms and what each exposes are cataloged in Module 5. This file is about how to work them.

Reading a Profile Analytically

A profile is not just its bio. When you analyze one, pull apart three layers:

• Stated facts — what the person typed: name, employer, location, links. Treat these as claims, not truth (verification is Module 7’s job).
• Structural facts — what the platform records around the content: account creation date, posting cadence, followers/following, tagged accounts, which posts are pinned. These are harder to fake than a bio.
• Incidental facts — what leaked in without intent: the street sign in a photo background, the reflection in a window, a badge on a lanyard, a screen visible behind someone, the weather, the language of a menu. Incidental facts are often the most valuable because the subject wasn’t curating them.

A worked mindset: a public post says “First day at the new job!” (stated). The account was created years ago and posts weekly (structural). The photo shows a lanyard with a building name and a parking sticker (incidental). The incidental layer just told you the employer and likely office location without the person ever naming them. This is exactly the “mosaic effect” from the intro script — harmless pieces combining into something sensitive.

Photo and video backgrounds

Treat every image as evidence, not decoration. Scan for: signage and street furniture, license plates, house numbers, storefronts, mountains or skylines, vegetation and season, architectural style, electrical outlet types (hint at country), and reflections. Video adds audio cues (accents, announcements, background noise) and often more frames to work with. The mechanics of pulling location out of an image are covered in 4.3-image-analysis-and-geolocation.md.

Pattern-of-Life Analysis

“Pattern-of-life” analysis means building a picture of someone’s routine from timestamped activity: when they post, from where, with whom, and doing what. Over enough data points it reveals working hours, commute, gym schedule, travel, relationships, and habits.

This is genuinely powerful and genuinely sensitive. The Strava heatmap case from the intro script is pattern-of-life at scale — aggregated exercise routes exposed the layout and patrol patterns of military bases. The same technique against an individual can reveal when a house is empty.

Ethics checkpoint (non-negotiable for this class): pattern-of-life analysis on a real, non-consenting person edges toward stalking and can cause real harm. In this course you only do it on yourself, on a classmate who has consented, or on an instructor-provided fictional persona. Collect only what an objective requires (minimization), and never publish a routine you’ve reconstructed about a real person. See Module 2.

Username Enumeration

People reuse handles. The same jsmith_92 often appears on a dozen platforms, and finding all of them turns one account into a full picture. Three tools dominate; they all work the same way — take a username, check hundreds of sites for a profile at that name, report hits.

WhatsMyName

WhatsMyName (WMN), created by Micah “WebBreacher” Hoffman in 2015, is a community-maintained dataset (wmn-data.json) describing how to check hundreds of sites for a username. The easiest way to use it is the free web app — no installation:

• Web app: whatsmyname.app — type a username, get results in the browser.

Because it is a dataset, WMN also powers many other tools (Blackbird, Spiderfoot, Maltego transforms, and more). For a quick check with nothing installed, the web app is the fastest option and the most OPSEC-friendly (you can reach it through a clean browser profile).

Sherlock

Sherlock is a command-line tool that hunts a username across 400+ social networks.

Install (pick one):

pipx install sherlock-project
# or on Debian 13+/Ubuntu 22.10+/Kali via the packaged version:
sudo apt install sherlock
# or Docker:
docker run -it --rm sherlock/sherlock

Basic usage:

sherlock user123
sherlock user1 user2 user3          # several usernames at once
sherlock user123 --csv              # also write a CSV
sherlock user123 --site Reddit --site GitHub   # limit to specific sites
sherlock user123 -o results.txt     # choose output file

Note the command is sherlock (from the sherlock-project package). Older tutorials show python3 sherlock.py from a cloned repo — that still works if you install from source, but the packaged sherlock command is now the standard.

Maigret

Maigret grew out of the Sherlock idea and goes much wider — it checks 3,000+ sites (default run covers the ~500 highest-traffic ones) and can even parse a found profile for extra identifiers to pivot on.

Install and basic run:

pip install maigret
maigret someusername

maigret user --html          # HTML report
maigret user --pdf           # PDF report
maigret user -a              # search all 3,000+ sites (slow)
maigret user --tags photo,dating   # only certain site categories
maigret user --csv           # CSV export
maigret --web 5000           # launch a local web interface on port 5000

Reading the results

All three tools produce candidate matches, not confirmed ones. Two different people can hold the same handle on different platforms, and some sites return false “exists” responses. Always open the hits and confirm they are the same person using corroborating detail (photo, bio, linked accounts, writing style) before you treat a match as real. Username enumeration finds leads; verification makes them findings.

Email-to-Account Pivoting (conceptual)

An email address is one of the strongest pivots in OSINT because so many services key accounts to it. Conceptually, an email can lead to:

• Account existence checks. Many sites reveal, through signup or password-reset flows, whether an address is registered — though probing these against a real person’s account can cross into unauthorized-access and harassment territory, so it is out of scope for class labs.
• Profile services. A Gravatar tied to an email can expose a profile photo and linked accounts; other lookup services (e.g. Hunter.io for email formats, Epieos for what’s linked to an address) map an email to a wider identity. These belong to the sources catalog in Module 5.
• Breach exposure. Checking whether an address appears in a breach (Have I Been Pwned) tells you the person exists and where they had accounts — but see Module 6 and Module 2: checking is fine; downloading or using leaked data is not.
• Username inference. The local part of an email (jsmith92@…) is frequently the same handle the person uses elsewhere — feed it straight into Sherlock/Maigret above.

We keep this conceptual on purpose. The mechanics that involve probing a live person’s accounts belong to authorized engagements, not a classroom, and always sit under the legal boundaries in Module 2.

OPSEC Reminder

Investigating social media is not free of footprints. Viewing a LinkedIn profile can notify the person; viewing an Instagram or Facebook story exposes you as a viewer; accidentally liking or following is a classic blunder. Do this work from a dedicated, logged-out research browser, never your personal account. Full treatment in Module 8.

Key Terms

• Username enumeration: checking many platforms for the same handle to find all of a person’s accounts.
• Pattern-of-life analysis: reconstructing a person’s routine from timestamped, geolocated activity.
• Pivot: using one identifier (username, email, photo) to discover another.
• Mosaic effect: individually harmless data points combining into sensitive knowledge.
• False positive: a tool reporting an account exists when it does not, or when it belongs to a different person.

Key Takeaways

• A profile has three layers: stated, structural, and incidental facts — the incidental ones are usually the most revealing.
• Pattern-of-life analysis is powerful and stalking-adjacent; only ever run it on yourself, consenting classmates, or fictional personas.
• People reuse usernames — enumeration turns one handle into a whole footprint.
• WhatsMyName (web app), Sherlock (400+ sites), and Maigret (3,000+ sites) are the standard username tools.
• Tool results are candidates; confirm each hit before trusting it.
• Email is a top-tier pivot, but probing a real person’s accounts belongs to authorized work, not class.

References

• Sherlock — GitHub
• Maigret — GitHub
• WhatsMyName — GitHub
• WhatsMyName web app