Advanced OSINT Username Techniques: Beyond the Basic Scan

Where the basic scan stops

Running a handle against a few hundred sites is the opening move, not the investigation. It gives you a list of strings that exist, which is not the same as a list of accounts belonging to your subject. Three problems remain, and they're where the actual work is: the subject probably uses handles you haven't derived yet, some of the most useful accounts no longer exist in their current form, and nothing so far distinguishes your subject from the other people who happen to hold the same string.

The techniques below address those three in order — permutation, historical retrieval, and de-confliction. All of them operate purely on public data and none require bypassing access controls.

Permutation: deriving handles you weren't given

People don't invent handles independently; they transform a base string according to a small set of habits, and those habits are consistent per person. Once you have two or three known handles, you can usually infer the rule and generate the rest.

Build a permutation list from the base and run it as a batch. Platform constraints also force predictable truncations, so derive the truncated forms deliberately: X caps handles at 15 characters, Reddit at 20, TikTok at 24 and Instagram at 30, which means a long base name will appear cut short — and cut short the same way each time — on the tighter platforms.

• •Separator swaps: the dot, underscore and hyphen forms of the same string, plus the no-separator version.
• •Affixes: real, official, its, im, the, mr, ms, hq, tv, yt, x, xX Xx, and the underscore-padded variants used when a name is taken.
• •Numeric tails: birth year in two and four digits, a jersey number, 1 through 9, 69, 420, and a repeated final digit.
• •Character substitution: leetspeak (3 for e, 0 for o, 1 for i), doubled letters, and a dropped vowel.
• •Name forms: first+last, f+last, first+l, initials, and the reversed order used on non-Latin-script origin accounts.
• •Locale and era markers: a country or city suffix, a graduation year, a game or fandom tag from the period the account was created.

Historical and structured sources

Deleted and renamed accounts are frequently the most informative ones, and a live scan misses them entirely. Google's cache: operator was retired in 2024, so archives and structured endpoints carry this work now.

• •Wayback Machine CDX API: query web.archive.org/cdx/search/cdx with a wildcard URL such as example.com/user/* and output=json to enumerate every archived profile path on a site, including handles that no longer resolve. Add collapse=urlkey to deduplicate.
• •archive.today: captures pages the Wayback Machine misses, particularly on sites that block its crawler, and preserves rendered JavaScript content.
• •Reddit's JSON endpoints: appending .json to a user or post URL returns structured data including created_utc, which gives you the exact account creation timestamp.
• •Snowflake IDs: Discord and X encode a creation timestamp inside the numeric account ID. Decoding one gives you an account's age to the millisecond, which is a strong corroboration and de-confliction signal.
• •Steam: resolve a vanity URL to a 64-bit SteamID through the Web API, then pivot on that ID across third-party trade and stats sites that index it.
• •Gravatar: the MD5 or SHA-256 hash of a lowercased email opens a public JSON profile that often lists linked accounts.
• •Git metadata: commit author emails are public, and appending .patch to a GitHub commit URL exposes them — a direct handle-to-email pivot.
• •Search operators: exact-phrase the handle in quotes, then narrow with site:, inurl: and intext: to catch forum signatures and comment histories that have no profile page.

De-confliction: proving one person, not one string

This is the step that separates intelligence from a list of coincidences. You need signals that are independent of the handle, because the handle is the thing that might be a collision. Aim for at least two, from different categories, before you upgrade a candidate from possible to probable.

• •Imagery: reverse image search the avatar on Yandex (strongest on faces), Google Lens and TinEye — TinEye's oldest-first sort tells you which account used the image first.
• •Temporal: build a histogram of posting times across candidate accounts. A consistent activity window implies a timezone, and two accounts with the same window and the same weekly rhythm are meaningfully correlated.
• •Chronological: compare account creation timestamps against known life events, and check whether the accounts were created in a plausible sequence.
• •Stylometric: idiolect gives people away — recurring misspellings, British versus American spellings, Oxford comma use, ellipsis habits, emoji selection, sign-offs, and the specific way they truncate words.
• •Network: overlap in followers, followed accounts, subreddit participation and Discord servers. Small-account overlap is far more probative than shared celebrity follows.
• •External fingerprints: the same Linktree, the same Amazon wishlist, the same Steam trade URL, the same referral code, the same self-hosted domain.
• •Negative evidence: actively look for a signal that would separate the accounts. If you can't state what would disprove the link, you have a hypothesis, not a finding.

Method, OPSEC and the lines that hold

Attribution work is only as good as its documentation. Record every finding with the full URL, the retrieval timestamp and a screenshot, because accounts change and delete while you're looking at them. Grade conclusions explicitly — confirmed, probable, possible — and keep the grade attached when you pass the work on, since stripping the confidence level is how a maybe becomes a fact two hops later. Note your reasoning, not just your result, so it can be checked.

On your own side: don't research from your personal accounts, since follows, views and profile visits are visible on many platforms and tip off the subject. Be aware that research accounts breach the terms of service on some sites and that automated collection at volume is a separate question again. And the boundaries stay where they always were — public data only, no credential stuffing, no defeating access controls, no pretexting, and no using enumeration output to harass anyone. Those aren't just ethics; several of them are the line between OSINT and a criminal offence, and the legal exposure sits with you rather than the tool.

For the enumeration step itself, a hosted scanner covers the breadth quickly: AliaScan checks a handle against 400+ maintained platforms in parallel and links each public profile, which is a fast first pass before you move into permutation and archive work. Like every tool in this category it reads only public pages, and every hit still needs the verification above.