The OSINT Newsletter #84

Username OSINT That Goes Beyond Tools

👋 Welcome to the 84th issue of The OSINT Newsletter. This is the first issue in the beginner OSINT series that will be released biweekly. These issues will be free with the goal of helping new investigators improve their skills. Here’s an overview of this issue:

• Username search tools

• Username variations

• Pivoting

• Case study

• Key takeaways

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Monitoring Live Webcams in a Single Pane of Glass

The OSINT Newsletter - Issue #83

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Episode 6 – The Spectrum of OSINT

Let’s get started. ⬇️

---

Usernames are the passports of the internet. Like passports, they’re stamped for everywhere you’ve been, even if you don’t remember going there: from forum posts to data breach repositories. Some people have more than one, whilst some use the same for ten years or more. Either way, they’re an invaluable source to understand who somebody is online.

In this issue, we’ll tell you how to get everything you need to know from usernames, and incorporate it into your investigation. We’ll cover:

• Username search 101

• Our favourite search tools

• Cracking common username variations

• What is pivoting? (and how to do it)

By the end, you’ll be using usernames like a pro. Let’s get going.

What is Username Search?

Put simply, username search is… well, searching with usernames. A typical search starts with a username, then uses it to show up every single place that handle (or a close-enough variant) has appeared online.

Username search is powerful because people often use the same username in multiple places. Even if they pick a new one, it probably contains parts of other handles they need to remember. So by lighting up all the places those parts have appeared, you can paint a pretty solid picture of somebody’s online self - where they’ve been, what they did, any aliases, even their email address or real name.

Username search might seem basic, but it’s one of the most powerful tools at an OSINT investigator’s disposal; it’s lightweight, fast, and yields high-value pivots (more on those later).

Username Search Tools 101

You can do username search with a Google dork (“username” site:example.com), or plug your target into a specially-made tool. But why spend hours dorking your target username by hand? You’re a professional - there’s no need to get your hands dirty. Try these tools instead.

Web apps (e.g. OSINT Industries)

For convenience and speed, you can use web apps. These point-and-click username search tools will do cross-platform checks for you, then aggregate the findings into a clear, concise report.

Typically, these tools will check all the major social platforms (the Facebooks and Xs of this world), along with WhoIs records, breach data, and more deep-cut forums. Some will even include out-there options like Strava or PornHub; if your target is dumb enough to use the same handle, or a similar string variant, they’ll pop up.

Of course, it’s important to check the output for veracity. But with built-in sourcing and reverse search capabilities, it’s much easier. Oh, and they’re usually automatically compliant with international law. So you won’t get arrested.

CLI Tools (e.g. Choose your fave)

Sometimes, the scale of your investigation is a little too big for web apps. If you need massive repeatable searching, command-line (CLI) tools will let you automate the process.

You can run multiple handle searches at once, chain results through other tools, slot everything neatly into scripts or pipelines… practically any element of the username search workflow can be combined and automated with CLI tools. The limit is your imagination. And coding skill, obviously.

Common Username Variations and How to Generate Them

Speaking of imagination: the majority of people are pretty unimaginative. How do we know? Well, if you’re the average person, you have one username that you use for multiple accounts. It might change a little, but those changes are pretty predictable - and that’s where heuristics come in.

Heuristics are problem-solving shortcuts; the rules that we use to simplify our decisions and find quick solutions. Most usernames are decided heuristically, to make them easy to remember. So even if they change, most variations will include:

• The letters of the person’s name

• Digits from their birth year

• Their location

• Zip or phone codes

• Their job or profession

• Significant (or meme) numbers

• Their dog’s name

• Etc.

This can help you come up with alternate usernames, and verify your results. For example, if your target is osintgod69, it might be worth looking for osintgod420. If your search also brings up osintgod44, that could confirm that the 44-year-old memelord you’ve identified is indeed your target.

You could also try:

• Delimiter swaps: osint.god69, osint_god69, osint-god69

• Numeric tweaks: osintgod420, osintgod6969, osintgod42069

• Leetspeak: 0sintg0d69, o51ntgod69

• Prefix/suffix: theosintgod, officialosintgod

• Abbreviation: osntgd

• Platform-specific additions: osintgod_ig, osintgod_x, osintgod_pornhub

It’s brute force and can take a long time, but it’s worth it. Consider using AI tools to save yourself some life energy. Also, streamline your search according to plausibility; in the case of osintgod69, it’s probably not worth searching osintgod67 - if he’s over 21, he’s far too old to know the meme.

What is Pivoting?

Pivoting is the OSINT term for moving from one piece of data to the next, then the next, then the next - following the chain of leads until you reach the truth. An example pivot chain looks like this:

username → profile page → email → other accounts → public posts → location or employer → full identity profile.

Pivoting properly all comes down to these five basic rules:

1. Collect contact clues: The “contact” section is your best friend; an email address is a priceless piece of data, and any naming patterns or organisational ties (like a company address) can give you more leads to search with.

2. Accept side quests: If you find a link, follow it. Socials and linked accounts might include more juicy information. Even if they just contain the same stuff you’ve seen before, they’re great for verification.

3. Check metadata: If the username leads you to accounts, check those accounts for images - and then check the metadata on those images. That’s a perfect example of pivoting.

4. Get your hands (slightly) dirty: Sometimes, you have to roll up your sleeves. Use any real names or partial identifiers to run manual searches. Try pairing the handle with a city, company, or keyword in quotes, or use site:dorks on socials.

5. Document everything: Before you draw conclusions, make sure you can trace your trail. Screenshot and timestamp everything, and note down any username variants or URLS. That way, every step in your reasoning can be backed up later. You might even get new ideas from reading it over.

Username Search in Action: The 44-Year-Old Memelord

For this issue’s example, let’s go back to our old friend osintgod69.

In this completely made-up investigation, we’re looking for a troll who’s been spamming a forum with questionable content - some of which may be against the law. We need evidence of who he is; along with his aliases, so we can comprehensively block him and bring him to justice.

Here’s what our pivot chain would look like:

osintgod69 → heuristic variant (0s1ntg69) → LinkedIn profile page for Greg Heffley, web developer at Best Company Ever in Toronto, born in 1981 → contact details (greg@bestcompanyever.com) → more variant usernames (0sintgod81, bestgregever44)→ other accounts → Toronto metadata → full identity profile.

So now we know our target is a 44-year-old web developer from Toronto. Get a life, Greg.

Key takeaways

• People are unimaginative: Variants are predictable, and make new leads

• Start wide, then narrow: generate plausible variants, then prioritize them by plausibility

• Preserve your life energy: Use web apps for speed, CLIs for scale and repeatability.

• Pivot pivot pivot: Accept all the side quests. Any link could become a lead.

• Check your answers: Verify everything manually and document your sources

---

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry there’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, plea