Username / Handle: Data Point Intelligence Guide

People change platforms, phones and email providers. They almost never change the handle they picked at fifteen. That inertia is the analyst's advantage and the subject's biggest operational security failure.

Understanding the Username / Handle as an intelligence artifact

A username is a self-selected identifier within a platform namespace, unique inside that platform and meaningless outside it. Structurally it is a short string constrained by each service's character rules and length limits, sometimes displayed alongside a separate, freely changeable display name. It represents choice rather than assignment, and that is precisely why it carries signal: unlike a system-generated identifier, a handle reflects the memory, preferences and habits of the person who chose it, and those tend to persist across years and services.

Analytically, distinguish the immutable account identifier some platforms assign underneath the visible handle from the handle itself, which can usually be changed or reassigned to another user. Also distinguish exact reuse from systematic variation, where a person appends numbers, birth years or separators when their preferred handle is taken, producing a predictable family of related handles rather than a single string.

Why it matters

Handle reuse is the backbone of cross-platform persona linkage. A distinctive username found on a marketplace, a code repository, a forum and a gaming platform can knit together disclosures the subject never intended to be read together: a work project on one, a home city on another, a photograph on a third. It also supports actor tracking, since criminal operators reuse handles across forums and rebuild reputation under the same name after a ban, and it provides a durable label when infrastructure changes.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Distinctiveness of the string, where a rare compound handle carries far more linkage weight than a common dictionary word or first name.
• Systematic variants such as appended years, underscores or leetspeak substitutions, revealing a family of accounts belonging to one person.
• Platform registration dates across services, establishing a timeline of adoption and abandonment for the persona.
• Content overlap between accounts sharing the handle, including reused avatars, bios, writing style and linked external sites.
• Handle appearance in code repository commits, package registries and forum signatures, which frequently exposes a real email address.
• Reuse of the handle as an email local part, providing a candidate address to test at common providers.
• Language, transliteration and keyboard-layout artifacts in the string that suggest a native language or region.
• Reappearance of the same handle after platform bans, marking persistence of an actor across enforcement actions.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• Sherlock and Maigret — Open-source enumeration of a handle across hundreds of platforms, reporting where an account with that name exists.
• WhatsMyName project data — Maintained detection rules for username presence across services, used by multiple tools and manually verifiable.
• GitHub and GitLab search — Commits, repositories and profile metadata often exposing a real name and committer email tied to the handle.
• Have I Been Pwned and breach index services — Whether an associated address appeared in breaches, giving service registration history for the persona.
• Archive.today and Wayback Machine — Historic captures of profiles and forum posts that have since been deleted or edited.
• Platform-native search on the services in scope — Authoritative confirmation that an account exists, with profile detail and posting history.
• Gravatar and avatar hash lookups — Links a handle or address to a reused profile image across multiple services.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Record purpose and basis — Define the investigative question, the lawful basis and the scope limits before enumerating any accounts belonging to an individual.
2. Assess distinctiveness — Estimate how common the handle is before drawing inferences, since generic strings will produce mostly unrelated accounts.
3. Enumerate presence — Check the handle across platforms using maintained detection rules, then manually verify each hit rather than trusting automated true results.
4. Generate variants — Derive systematic permutations such as appended digits, separators and common substitutions, and check those alongside the original string.
5. Corroborate content — Compare avatars, bios, external links, writing style and posting times across candidate accounts to distinguish the subject from namesakes.
6. Pivot to stronger identifiers — Move from the handle to email addresses, committer identities or linked domains, which support attribution far better than a shared name.
7. Grade and document — Record confidence for each linkage with the corroborating evidence, and explicitly note accounts assessed as unrelated coincidences.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

• Social Media Intelligence — Intelligence from Social Platforms and Networks
• Human Intelligence — Information from People, Ethically Obtained
• Dark Web Intelligence — Hidden Services and Closed Criminal Venues
• Threat Actor Intelligence — Tracking Adversary Groups Over Time
• Criminal Intelligence — Intelligence Supporting Criminal Investigation
• Cyber Intelligence — Adversary Activity in Networks and Systems
• Identity Intelligence — Resolving and Verifying Who Someone Is
• Disinformation Intelligence — Detecting and Analyzing Information Manipulation
• News Intelligence — Media Reporting as an Intelligence Source
• Legal Intelligence — Law, Litigation, and Regulatory Intelligence

Investigated in these domains

• Dark Web Intel
• Operational Security
• Insider Threat
• Child Protection
• Extremism & Radicalization
• Election Security & PSYOP
• Disinformation / IO

Pivots to these data points

• Person / Name — A named individual — the subject of identity resolution and profiling.
• Email Address — Electronic mail address tied to an individual or organization.
• Phone Number — Telephone number for voice, SMS, or messaging identification.
• Physical Address — A physical or mailing address tied to a person, company, or registered entity.
• Social Profile — A social media profile or online account page tied to a persona or identity.
• Device / Advertising ID — A mobile advertising or device identifier used in adtech data to track and locate devices.

Inside the platform: where Username / Handle lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• datapoint.php?dp=dp_username — Data point hub
• domain.php?d=darkweb — Dark Web Intel dashboard
• domain.php?d=opsec — Operational Security dashboard
• domain.php?d=insider — Insider Threat dashboard
• domain.php?d=cp — Child Protection dashboard
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Enrichment Runner
• Enrichment → Local
• Correlate Infrastructure
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Record purpose and basis is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Enumerate presence turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Grade and document feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Username / Handle

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Handles matter to defence work in two directions. Defensively, personnel operational security reviews check whether service members reuse identifiable handles across recreational and professional platforms, which is a recurring route to targeting and social engineering of deployed units and their families. Analytically, handle persistence supports tracking hostile actors across forums and marketplaces where infrastructure changes constantly. Constraints are firm: enumerating the online presence of an identifiable individual requires authority, collection on own nationals is restricted in most national frameworks, and handle reuse establishes tooling and persona continuity rather than identity, which must be stated plainly in any product.

🕵 National intelligence

Handle continuity is one of the few durable persona identifiers in an environment where infrastructure rotates weekly. Requirements driven use covers tracking a known actor across platform bans and rebrands, identifying recruitment and procurement personas, and recognising when a persona is retired and replaced. Minimisation matters because enumeration across platforms rapidly produces a profile far more intrusive than any single observation, including inadvertent special category material such as religious or political community membership. Record what was observed and where, keep the assessment separate from the observation, and apply handling rules to any incidentally collected persons who share the handle.

👮 Law enforcement

For law enforcement a handle is an investigative lead and a route to legal process, not evidence of identity. Platforms hold the account records, registration address, login history and payment data that actually identify a user, and those require a production order, warrant or mutual assistance request naming the platform's internal account identifier where possible rather than the display handle, which can be changed. Preserve profile content with hashes and capture times before requesting takedown or serving process, since accounts are deleted quickly. Handle reuse supports linking accounts as an investigative theory; identity comes from platform records and corroborating evidence.

🔍 Private investigation and corporate security

Corporate investigators use handles for insider risk indicators, brand and executive impersonation detection, and verification of claimed professional history. The permitted ground is observation of publicly visible information for a defined purpose with a recorded balancing test. What is not permitted is creating fake accounts to view restricted content, sending connection requests to gain access, engaging the subject, or continuous monitoring of a private individual that would amount to harassment. Deliverables should distinguish confirmed accounts from candidates, state the collision risk for the specific handle, and avoid building a comprehensive life profile when a narrow answer was requested.

📰 Journalism and OSINT media

Handle linkage is powerful for identifying who is behind an anonymous account, and it is also where reporting most often goes wrong. Verification requires assessing how distinctive the string is before drawing any inference, corroborating with content evidence such as reused avatars, writing style, timezone consistent posting and external links, and preferring documentary confirmation such as a committer address or a registration record. Impersonation accounts deliberately reuse handles, so presence proves nothing about operation. Consider the safety consequences of unmasking, particularly where the person may be a whistleblower or an activist, and always seek comment before publishing.

🌍 NGO, humanitarian and human rights

Civil society use is usually protective: helping activists, journalists and survivors understand how their handle reuse exposes them, and documenting harassment networks that operate across platforms. Victim centred practice means working with the person's consent and returning findings to them, never demonstrating exposure by publishing it. Do no harm applies acutely, since unmasking a pseudonymous account in a repressive context can be lethal, and the same techniques used for accountability can be turned against defenders. Document harassment for platform escalation and accountability using preserved captures, and store any linkage analysis under strict access control.

🎓 University and research

Researchers study handle reuse for identity linkage, disinformation network analysis and privacy risk quantification, and the ethics burden is substantial because the output is deanonymisation. Institutional review is normally required even for publicly visible data, and review boards increasingly expect a justification for why linkage is necessary and how subjects are protected. Method must report the platform set, the detection rules used, the false positive rate of automated enumeration, and how handle distinctiveness was estimated, since results are meaningless without a base rate. Publish aggregate findings and code, never linked account sets for identifiable individuals.

Playbook: working Username / Handle end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Record purpose, basis and limits

Document the investigative question, the lawful basis, why enumeration across platforms is necessary and proportionate, and the retention period. Explicitly record prohibited actions: account creation to view restricted content, connection requests, and any engagement with the subject. A good output is an authorisation naming the platforms in scope. Stop if the request is to build a general profile of a private individual rather than answer a defined question.

Phase 2 — Estimate distinctiveness first

Before enumerating anything, assess how common the string is. A dictionary word, a common forename or a short numeric handle will match thousands of unrelated people, and any linkage built on it is worthless. Test the string against large public corpora and consider length, character mix and semantic rarity. A good output is a distinctiveness rating that sets the confidence ceiling for everything that follows. Stop and reconsider the approach if the handle is generic.

Phase 3 — Derive the variant family

Generate systematic permutations that people actually use when a preferred handle is taken: appended digits and birth years, underscores and dots, doubled letters, character substitutions and truncations. Search the family alongside the original, since the variants often belong to the same person. A good output is a variant set with the generation rules recorded. Stop when the rules are documented so another analyst could reproduce the set exactly.

Phase 4 — Enumerate presence with maintained rules

Check the handle and variants across platforms using maintained detection rules, understanding that many services return ambiguous responses that tools interpret as positive. Treat every automated result as unverified. A good output is a candidate account list annotated with the detection method and its reliability for each platform. Stop when enumeration is complete; the results are leads, not findings.

Phase 5 — Verify each hit manually

Visit each candidate through the platform's normal public interface and confirm the account exists, capturing the profile, the internal account identifier where exposed, creation date and visible content. Automated false positives are routine and propagate into reports if unchecked. A good output is a verified account list with captures and identifiers. Stop when every candidate is confirmed, excluded or marked as unresolvable.

Phase 6 — Capture the immutable identifier

Where the platform assigns a numeric or opaque account identifier beneath the visible handle, record it, because it survives renaming and account rebranding while the handle does not. This is the identifier to use in preservation and production requests. A good output is a mapping of handle to platform identifier per account. Stop when identifiers are captured for every account you intend to rely on.

Phase 7 — Corroborate with content evidence

Compare avatars and their hashes, biography text, external links, writing style, language and transliteration artifacts, posting time distributions and shared contacts across candidate accounts. Linkage should rest on content correspondence, not on the shared string. A good output is a correspondence table with the specific evidence per account pair. Stop when each linkage has at least two independent content corroborations.

Phase 8 — Test the impersonation hypothesis

Deliberately consider whether a matching account is an impersonator, a fan account, a squatter who took the handle after abandonment, or an unrelated namesake. Check creation dates against the subject's known activity and look for content that contradicts the linkage. A good output is an explicit alternative hypothesis assessment. Stop when you can explain why the account is the subject's rather than any alternative.

Phase 9 — Pivot to stronger identifiers

Move from the handle toward artifacts that carry real attribution weight: committer addresses in public repositories, addresses in package manifests, registration records, published contact details in filings, or platform identifiers usable in legal process. A good output is a set of documentary identifiers with their sources. Stop when the case rests on documentary evidence rather than on string similarity.

Phase 10 — Preserve before anything changes

Capture profiles, posts and media with timestamps and hashes, and use independent archiving services so the capture is third party verifiable. Accounts are deleted or renamed within hours of a subject sensing attention. A good output is an archived, hashed evidence bundle with retrieval times. Stop when preservation covers everything you intend to cite.

Phase 11 — Assess collateral and special category exposure

Review what the enumeration has revealed incidentally: religion, political affiliation, sexuality, health or family members inferable from platform membership. Remove anything not necessary for the stated purpose and record the justification for what remains. A good output is a minimised record with a special category note. Stop when unnecessary inferences are removed before the product is circulated.

Phase 12 — Grade, restrict and review

Assign confidence per linkage with the evidence supporting it, record accounts assessed as unrelated coincidences, restrict access, and apply the retention period. Negative findings matter because they prevent the same false lead being re investigated. A good output is a graded record with exclusions and a deletion date. Stop when retention is scheduled and access is limited to the case team.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
WhatsMyName project	Open	Maintained community ruleset defining how to detect account presence on hundreds of platforms, with response signatures and known reliability caveats.	The underlying detection data behind most enumeration tooling, and the reference for judging which platform results are trustworthy.
Sherlock	Open	Open source enumeration tool checking a handle across a large set of platforms and reporting where accounts appear to exist.	First pass enumeration to generate candidates, always followed by manual verification of each reported hit.
Maigret	Open	Enumeration tool that additionally extracts profile metadata and cross references discovered identifiers across services.	Enumeration plus initial metadata collection, which shortens the corroboration step for high volume candidate sets.
GitHub search and commit metadata	Registration	Public repositories, commits, package manifests and profile data frequently exposing committer addresses, real names and organisational affiliation.	Converts a handle into documentary identifiers, which is the single most productive pivot available from a username.
GitLab and public code hosting search	Registration	Alternative code hosting with equivalent commit metadata, profile information and project membership visible publicly.	Extends repository based pivoting where the subject uses hosting other than the largest provider.
Have I Been Pwned	Open	Breach exposure service reporting which known breaches include a given address, with dates and affected services.	Where a candidate address is derived from the handle, establishes which services the persona registered with and when.
Internet Archive Wayback Machine (archived)	Open	Historic captures of profile pages, forum threads and posts including content later deleted or edited by the account holder.	Recovers earlier versions of a profile where the handle, biography or linked sites differed, which often carries the linkage evidence.
Conifer by Rhizome	Open	On demand web archiving service producing timestamped, replayable captures including dynamic and scripted social content.	Third party verifiable preservation of profile evidence at the moment of capture, before deletion or renaming.
Gravatar and avatar hash services	Open	Profile image services keyed to an address hash, plus general image hashing for comparing avatars across platforms.	Links accounts through reused profile imagery, which is far stronger corroboration than a shared handle.
Package registries such as npm and PyPI	Open	Public package metadata including maintainer handles, contact addresses, repository links and publication history.	Ties a development handle to an address and to dated publication activity with documentary provenance.
Keybase and public key directories	Open	Cryptographic identity services and key servers where users publish verified links between handles across platforms.	Provides subject asserted linkage between accounts, which is strong evidence when the proofs validate.
Platform native search and public profile interfaces	Registration	Authoritative confirmation that an account exists, with profile detail, creation date and any exposed internal identifier.	The only reliable verification of enumeration results, and the source of identifiers needed for legal process.
Ahmia and public onion search indexes	Open	Search indexes covering publicly reachable hidden services where criminal forum handles frequently appear.	Tracks actor handles across marketplaces and forums where handle reuse and reputation carry operational value.
Berkeley Protocol on Digital Open Source Investigations	Open	Methodological standard covering verification, provenance, preservation and analysis of online material for accountability use.	Framework for documenting persona linkage so it survives adversarial challenge and legal scrutiny.
Bellingcat online investigation resources	Open	Published methodology and case studies covering account linkage, verification and the limits of open source persona analysis.	Practical technique reference and worked examples of how linkage claims are validated and where they fail.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Username / Handle. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Sherlock — Checks a handle across hundreds of platforms quickly from the command line. Limitation: substantial false positive rate because many sites return ambiguous responses for absent accounts.
• Maigret — Enumerates presence and extracts profile metadata for cross referencing. Limitation: same ambiguity problem, plus platform changes silently break detection rules.
• WhatsMyName rule data — Maintained detection signatures used across multiple tools with community review. Limitation: coverage skews toward English language and Western platforms.
• Image hashing tooling — Compares avatars across accounts using perceptual hashes robust to resizing and recompression. Limitation: common stock and default avatars produce meaningless matches.
• Hunchly — Captures every page visited during an investigation with hashes and timestamps automatically. Limitation: capture fidelity varies on dynamic and infinite scrolling content.
• Conifer and Wayback capture — Creates third party verifiable snapshots of profile evidence. Limitation: some platforms block archiving, leaving gaps precisely where evidence matters most.
• Stylometry toolkits — Compare writing style across accounts as corroborating evidence for common authorship. Limitation: reliability drops sharply with short texts and is easily confounded by translation.
• Case management with capture provenance — Stores verified accounts, identifiers, captures and confidence grades under access control. Limitation: only as good as analyst discipline in recording exclusions as well as matches.
• Timezone and activity analysis scripts — Derive posting time distributions to estimate an operator's working hours. Limitation: scheduling tools, travel and shared accounts all distort the distribution.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Estimate distinctiveness before you enumerate. A handle's linkage value is inversely proportional to its frequency, and skipping this step is how analysts produce confident cross platform profiles of several different people at once.
• Capture the platform's internal account identifier, not just the visible handle. Handles are renamed and reassigned, and a production request naming a display name that has since changed will return nothing or the wrong account.
• Automated enumeration output is a hypothesis list. Many platforms return the same response for existing and absent accounts, so a tool reporting a hundred hits typically means a dozen real accounts and a lot of ambiguity.
• Handle reuse after a ban is a behavioural signature in its own right. Reputation is the scarce resource on criminal forums, and operators repeatedly rebuild under the same name because starting fresh costs them business.
• Avatar reuse corroborates better than the handle. Perceptual image hashing across candidate accounts catches linkage that string matching misses and provides evidence that does not depend on the name at all.
• Absence of reuse is expected from disciplined actors, not exculpatory. Compartmentalised handles per operation are basic tradecraft, so a clean enumeration result says nothing about whether the persona is genuine.
• Beware the squatter. Abandoned handles are reclaimed by unrelated users, so an active account may have no connection to historic activity under the same name; always check creation dates against the period of interest.
• Record the accounts you excluded and why. Negative findings prevent the same false lead being re opened, and they are the evidence that you tested alternatives rather than confirming the first plausible match.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Username / Handle is producing anything, and they are worth baselining before you change process or tooling.

• False positive rate of automated enumeration after manual verification, tracked per platform so unreliable detection rules can be retired.
• Proportion of linkage conclusions supported by at least two independent content corroborations rather than by the shared string alone.
• Share of investigations where the platform internal account identifier was captured, measuring readiness for legal process.
• Rate at which preservation captures were taken before any subject facing action, sampled from case records.
• Number of alternative hypotheses formally excluded per linkage, measuring whether impersonation and collision were tested.
• Frequency of downstream correction to persona linkage findings, tracked as the primary quality outcome.
• Retention compliance for persona enumeration records, measured as the proportion deleted on schedule.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Handle collision is routine, and common usernames are held by thousands of unrelated people across different platforms.
• Automated enumeration tools produce heavy false positives because many sites return ambiguous responses for both existing and absent accounts.
• Handles are reassigned after account deletion, so an active profile may belong to someone entirely unconnected to the historic activity.
• Impersonation accounts deliberately reuse a target's handle, so presence proves nothing about who operates the account.
• Sophisticated actors compartmentalise handles per operation, so absence of reuse is expected rather than exculpatory.
• Building a full cross-platform profile of a private individual can constitute harassment or unlawful surveillance without a clear investigative mandate.

Legal and ethical considerations

A username tied to an identifiable person is personal data, and aggregating an individual's presence across platforms creates a profile whose intrusiveness far exceeds any single source. Apply proportionality: collect only the accounts relevant to the investigative question, avoid special category inference such as sexuality, religion or health drawn from platform membership, and set retention limits. Do not create accounts, send connection requests or otherwise interact with the subject without authorisation, since covert engagement raises entrapment and platform terms issues.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Username / Handle, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 intelligence disciplines, 7 mission domains, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

How much does a matching handle actually prove?

By itself, very little, and how little depends entirely on distinctiveness. A common word or forename will be held by thousands of unrelated people across platforms, so the match carries almost no information. A rare compound string with an unusual character pattern is far more informative but still not proof, because impersonators, fans and squatters all reuse handles deliberately. Treat the match as the reason to look, then build the case on content correspondence, reused imagery, documentary identifiers and platform records. If the only evidence is the string, you do not have a linkage.

Can I create an account to see a private profile?

Not without specific authorisation, and for most private and corporate actors that authorisation does not exist. Creating a fictitious account breaches platform terms, which can undermine the admissibility of everything gathered through it, and engaging a subject through such an account raises entrapment and harassment issues. Law enforcement and intelligence use of covert online personas is governed by specific authorisation regimes in most jurisdictions and requires a documented legend policy. If content is not publicly visible, the route is legal process to the platform, not a fake account.

Which platform should I pivot to first?

Public code hosting, every time, if the handle appears there. Commit metadata records an address automatically for every commit, contributors rarely clean it up, and the result is a dated documentary link between a handle and a mail address. Package registries are similarly productive. After that, look for key servers and identity proof services where users publish self asserted links between accounts. Social platforms are the weakest pivot, produce the highest collision rates, and are where techniques that alert the subject are most tempting and most damaging.

How do I handle an obvious impersonation account?

Document it and separate it clearly in your reporting. Capture the profile with hashes and timestamps, note the creation date, and record the specific evidence distinguishing it from the genuine account, typically creation date, follower composition, content quality and the absence of corroborating identifiers. Impersonation of a client executive is itself a reportable finding and a platform enforcement matter. The analytical risk is that an impersonation account is folded into a linkage cluster and used to attribute someone else's statements to your subject, which is a serious error.

Is cross platform enumeration of a private individual lawful?

It depends on purpose and proportionality, not on the data being visible. Regulators treat the aggregation of individually public items into a profile as new processing requiring its own justification, and building a comprehensive picture of a private person without an investigative mandate can amount to unlawful surveillance or harassment. Define the question narrowly, collect only the accounts relevant to it, avoid inferring special category attributes from platform membership, record the necessity assessment and set a retention period. Visibility is never the basis for processing.

What do I do when the handle is generic?

Change approach rather than push on. Generic handles produce enumeration results dominated by unrelated people, and no amount of manual verification recovers a signal that was never there. Work instead from a stronger starting identifier: an address, a domain registration, a platform account identifier, or a distinctive combination such as handle plus a specific avatar or biography string. Where you must work with the generic handle, restrict searching to the platforms where you have independent reason to believe the subject is present, and grade every result low.

How should posting time analysis be used?

As weak corroboration only. Aggregating timestamps across a large volume of posts can indicate an operator's likely working hours and therefore a rough timezone band, which is useful for testing a claimed location. It is easily confounded: scheduling tools, automation, travel, shift work, shared account operation and platforms displaying times in the viewer's timezone all distort it. Use a large sample, state the timezone convention of the data source, present the result as a distribution rather than a conclusion, and never treat it as evidence of location on its own.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• GDPR Articles 5, 6 and 9 with equivalent national law, governing lawful basis, minimisation and special category inference when profiling individuals across platforms.
• Regulation of covert online activity, such as the United Kingdom Investigatory Powers and covert human intelligence source regimes, which governs use of fictitious personas.
• Platform terms of service and developer policies, which constrain automated enumeration, scraping and account creation and affect evidential admissibility.
• Berkeley Protocol on Digital Open Source Investigations, setting verification, preservation and provenance standards for online persona evidence.
• ISO/IEC 27037 and ISO/IEC 27042, covering preservation and analysis of digital evidence including web captures of profiles.
• Association of Internet Researchers ethical guidelines, the reference framework for research involving online communities and identifiable users.
• Editors code of practice and equivalent journalistic standards, governing identification, privacy and right of reply when unmasking pseudonymous accounts.
• Computer misuse legislation, which bounds any technique involving unauthorised access to accounts or circumvention of access controls.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. WhatsMyName project — WhatsMyName community. Maintained detection ruleset for identifying account presence across online platforms.
2. Sherlock project — Sherlock Project. Open source tool for enumerating a username across a large set of platforms.
3. Have I Been Pwned — Have I Been Pwned. Breach exposure notification service used to establish service registration history for a persona.
4. Internet Archive Wayback Machine — Internet Archive. Historic capture service used to recover deleted or edited profile content. (archived copy — the publisher moved or withdrew the original)
5. Berkeley Protocol on Digital Open Source Investigations — UN OHCHR. Standard for verification, preservation and provenance of online material used in accountability work.
6. Online investigation methodology resources — Bellingcat. Published techniques and case studies covering account linkage and verification practice.
7. Internet research ethical guidelines — Association of Internet Researchers. Reference ethics framework for research involving identifiable online users and communities.
8. Meta transparency and platform data resources — Meta. Documentation on platform data access, transparency reporting and legal process routes.
9. OpenPGP public key directory — keys.openpgp.org. Public key service where users publish cryptographic identity and linked identifiers.
10. ISO/IEC 27037 digital evidence guidance — ISO. International standard for identification, collection and preservation of digital evidence.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: correlates handle reuse and variants across platforms with verification prompts, confidence grading and purpose-bound retention. Explore the platform, or browse the rest of the library by following any tag above.