GDE-010 |
Username pivoting | |||||||
Identity verification | ||||||||
July 2026 | ||||||||
01
What it is
Sherlock OSINT is the use of the open-source Sherlock tool to check a single username against 400-plus social networks and websites in one pass, surfacing accounts a single-platform lookup would miss.
WhatsMyName is the default cross-platform username pivot in most Signal & Shadow workflows, including Step 04 of the Email OSINT guide. It is not the only maintained site list. Sherlock is a separately maintained, MIT-licensed project that checks a different set of 400-plus platforms using its own detection logic, so it frequently confirms a WhatsMyName hit independently, or surfaces a platform WhatsMyName does not check at all.
This guide covers running Sherlock as a companion pivot: how to install it, how to compare its results against WhatsMyName's, and when a second tool, Blackbird, is worth adding as a third opinion on a disputed or high-value hit.
|
When to use this guide
|
02
How to run a Sherlock username pivot
Install Sherlock, run it against a candidate handle, and treat every hit as a lead requiring the same corroboration WhatsMyName results need.
The following tools are used across the steps below. All are free unless noted.
Sherlock: Open-source, MIT-licensed username search tool. Checks a handle against 400+ sites via direct, unauthenticated HTTP requests. No account or API key required. Command line, installable via pipx, pip, or Docker. Free.
Blackbird: Open-source username and email search tool covering 600+ platforms, with metadata extraction. Useful as a third opinion when Sherlock and WhatsMyName disagree on a platform. Free. Requires Python.
|
Before you begin Stop at the login. Sherlock and Blackbird send only unauthenticated HTTP requests to public profile URLs. Neither logs in, resets a password, or requires an account. A returned hit is a URL to visit manually, not permission to interact with the account behind it. Legal considerations. Usernames and the account lists derived from them can constitute personal data under GDPR and equivalent frameworks once linked to a real person. Ensure a documented lawful basis before running a pivot, and do not retain results beyond the active investigation period. |
Install Sherlock via pipx or Docker and run it against the candidate username with the print-found flag to suppress negative results. Record every positive hit with its URL. Sherlock's site list is maintained separately from WhatsMyName's, so expect partial overlap rather than a superset or subset of WhatsMyName's results.
Build a simple table of platform names against which tool or tools returned a hit. Platforms confirmed by both carry higher confidence. Platforms found by only one tool are not automatically wrong; they may reflect a gap in the other tool's site list, but they need the same manual verification either way.
For any platform that matters to the investigation and appeared in only one of Sherlock or WhatsMyName, run Blackbird against the same handle. Blackbird's broader platform count and metadata extraction can confirm a hit or reveal that the account belongs to an unrelated user sharing the same handle.
For each platform confirmed by two or more tools, visit the profile directly and record any available metadata: profile photo, bio text, join date, and post history. A matching handle alone is not attribution; matching metadata across platforms strengthens the case considerably.
Screenshot or export the raw output from each tool with the timestamp and exact handle used. Note the tool version, since site lists change between releases and a rerun weeks later may return different results.
|
03
What to watch for in username pivoting
Handle-reuse traps and tool-specific false positives that undermine cross-platform attribution.
Common or generic handles: A short or common username, single first names, common word combinations, will return hits across dozens of platforms belonging to unrelated people who happen to share the string. Verifying check: Require corroborating metadata, a matching bio, photo, or cross-reference, before attributing any hit from a common handle to the subject.
False positives from generic response pages: Both Sherlock and Blackbird detect account existence by HTTP status codes and page content; some platforms return a 200 status for both valid and invalid usernames, which the tools' site definitions do not always catch. Verifying check: For any platform flagged as a hit, visit the URL directly and confirm an actual profile page loads rather than a generic not-found page returning a 200 status.
Tool-list staleness: Sherlock's and Blackbird's site definitions are community-maintained and can fall behind a platform's URL structure or authentication changes, producing false negatives on platforms that do exist. Verifying check: For a platform material to the investigation that returns no hit, check the platform manually before concluding the handle is not registered there.
Chain of custody: Username-linked accounts can be renamed, deleted, or made private with no notice, particularly once an investigation's presence becomes known.
Screenshot every positive hit from Sherlock, WhatsMyName, and Blackbird at the time of discovery with the timestamp visible.
Record the exact handle and tool version used for each run.
Archive any corroborated profile page via the Wayback Machine and record the capture URL.
Log every manual metadata verification performed in step 04, including what was checked and the result.
04
Go deeper
Reference cards and the parent workflow this deep-dive extends.
Reference cards
AIV-P001 Cross-platform username attribution with AI
SOC-001 Social media account verification for investigators
Related guides
GDE-005 Email OSINT: trace an address to accounts and infrastructure
GDE-009 Email account enumeration: tools beyond Holehe check
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.