hunt-a-handle

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Hunt a handle

追踪Handle

Handle reuse is the cheapest strong link in OSINT: one string, checked in minutes, potentially tying a dozen platforms to one person. It is also the most over-trusted. Enumerators do not verify identity — they perform HTTP existence checks — and a hit list is a list of candidates, nothing more. The mistake that ruins these investigations is pasting the tool's output into the report. Enumeration is the cheap half; confirmation is the work.

Handle复用是OSINT中成本最低的强关联线索：只需一个字符串，几分钟内即可完成检查，有可能将十几个平台与同一个人关联起来。但这也是最容易被过度信任的线索。枚举工具不会验证身份——它们只是执行HTTP存在性检查——所以命中列表只是候选列表，仅此而已。毁掉这类调查的错误就是直接将工具输出粘贴到报告中。枚举是简单的那一半；确认才是核心工作。

Step 1 — Authorized scope

步骤1 — 授权范围

Read ../../ETHICS.md and write down, before any query: subject, objective, in-bounds selectors, out-of-bounds actions (logging in, contacting, requesting follows), and the governing jurisdiction. Handle hunting drifts easily — one run hands you thirty new platforms, and it is trivial to end up profiling an uninvolved person who shares the string.

Done when scope is written down and you can name what would put you out of bounds.

阅读../../ETHICS.md，并在进行任何查询之前写下：调查对象、目标、允许的选择器、禁止的操作（登录、联系、请求关注）以及适用的管辖区域。Handle追踪很容易偏离范围——一次运行就能给你带来30个新平台，很容易最终分析到一个无关的、恰好使用相同字符串的人。

完成标志：已写下范围，并且能明确说出哪些行为会超出范围。

Step 2 — Pick your enumerator

步骤2 — 选择枚举工具

Holding	Reach for	Why
One handle, need breadth fast	`sherlock`	Largest quick sweep, existence only
One handle, need profile content	`maigret`	Parses the page: display name, bio, IDs, links, sometimes country and creation date
Need to see why a hit fired	WhatsMyName data	Every check is a declared URI plus a match rule you can read
A handle on one known platform	Manual visit	Nothing beats reading the actual profile

bash

sherlock jdoe_92 --timeout 10 --csv
maigret jdoe_92 --html

maigret is the higher-value tool for correlation because it returns fields, not booleans. A display name, avatar URL, self-declared location, numeric user ID and an "also known as" list give you material to test the next platform against. Sherlock gives you a URL and a claim.

WhatsMyName is a detection list, not a scanner: a JSON file of site entries, each with a URI template and explicit match criteria (an expected HTTP status and an expected string in the body, plus the equivalent for "missing"). Read the entry for any site you doubt — it tells you exactly what the tool considered proof. Many wrappers and web front-ends consume the same list, so a hit in three different tools is often one rule firing three times, not three independent confirmations.

Done when every candidate is recorded with platform, URL, the tool that found it, and live/dead status.

场景	选择工具	原因
单个Handle，需要快速覆盖大量平台	`sherlock`	覆盖范围最广的快速扫描工具，仅检查存在性
单个Handle，需要获取个人资料内容	`maigret`	解析页面内容：显示名称、简介、ID、链接，有时还包括国家和创建日期
需要了解命中原因	WhatsMyName数据	每个检查项都包含明确的URI和可查看的匹配规则
已知某平台上的Handle	手动访问	没有什么比直接查看实际个人资料更准确

bash

sherlock jdoe_92 --timeout 10 --csv
maigret jdoe_92 --html

maigret是关联分析中价值更高的工具，因为它返回的是字段，而非布尔值。显示名称、头像URL、自我声明的位置、数字用户ID以及“别名”列表，为你提供了在其他平台验证的素材。Sherlock仅提供URL和存在性声明。

WhatsMyName是一个检测列表，而非扫描器：它是一个包含网站条目的JSON文件，每个条目都有URI模板和明确的匹配标准（预期的HTTP状态码、预期的页面字符串，以及“未找到”对应的标准）。对于任何你存疑的网站，查看其条目——它会明确告诉你工具将什么视为存在的证据。许多包装器和Web前端都使用同一个列表，因此三个不同工具中的命中往往是同一个规则触发了三次，而非三次独立的确认。

完成标志：已记录每个候选条目，包括平台、URL、发现工具以及账户状态（存在/不存在）。

Step 3 — Generate variants

步骤3 — 生成变体

The handle you were given is one point in a person's naming habit. Recover the habit and you find the accounts the first sweep missed.

Separator swaps:
```
john.doe
```
,
```
john_doe
```
,
```
john-doe
```
,
```
johndoe
```
Truncations and initials:
```
jdoe
```
,
```
johnd
```
,
```
j_doe
```
,
```
doej
```
Number suffixes: birth year, birth year two-digit,
```
1
```
,
```
99
```
,
```
007
```
Leetspeak and character substitution:
```
j0hnd0e
```
,
```
johnd0e
```
Email local part as handle, and handle as email local part
Gamer-tag morphology: prefixes,
```
xX…Xx
```
, clan tags, doubled letters

Full pattern list: reference/variant-patterns.md.

Two inference directions matter. Handle → name:

jdoe_92

suggests a first-initial-lastname pattern and a 1992 birth year, which is a hypothesis to test, not a finding. Name → handle: if you already have a real name, generate the handles that name would plausibly produce and enumerate those too — it often outperforms starting from a handle someone gave you.

Done when the variant set is enumerated and the ones that produced hits are folded back into Step 2.

你得到的Handle只是一个人命名习惯中的一个点。找出其命名习惯，就能找到第一次扫描遗漏的账户。

分隔符替换：
```
john.doe
```
、
```
john_doe
```
、
```
john-doe
```
、
```
johndoe
```
截断与缩写：
```
jdoe
```
、
```
johnd
```
、
```
j_doe
```
、
```
doej
```
数字后缀：出生年份、两位出生年份、
```
1
```
、
```
99
```
、
```
007
```
黑客语（Leetspeak）与字符替换：
```
j0hnd0e
```
、
```
johnd0e
```
将邮箱本地部分作为Handle，或将Handle作为邮箱本地部分
游戏ID形态：前缀、
```
xX…Xx
```
、Clan标签、重复字母

完整模式列表：reference/variant-patterns.md。

有两种重要的推理方向。从Handle到姓名：

jdoe_92

暗示了“名首字母+姓氏”的模式以及1992年出生，这是一个需要验证的假设，而非结论。从姓名到Handle：如果你已经知道真实姓名，生成该姓名可能对应的Handle并进行枚举——这通常比从他人提供的Handle开始效果更好。

完成标志：已枚举变体集，并将产生命中的变体合并回步骤2。

Step 4 — Confirm, or reject

步骤4 — 确认或排除

For each candidate, look for evidence that survives a skeptical reader.

Strong:

Same avatar. Verify with
```
find-the-original-image
```
— a match to a stock photo or a third party's picture is a rejection, not a confirmation.
Byte-identical or near-identical bio text, especially with a typo or an unusual phrasing carried across.
A self-declared cross-link: the profile links the other profile. Best evidence available short of an admission.
A contact selector present on both (same email, same personal domain).

Moderate:

Account creation dates clustering in a narrow window across platforms — people sign up for things in bursts.
Follower/following overlap with the same distinctive small accounts.
Writing style: idiom, punctuation habits, timezone of posting.

Weak on its own: the handle matching. That is the thing you are testing, not evidence for it.

Platforms exposing a numeric user ID are disproportionately useful. Where IDs are issued in registration order, the ID bounds an account's creation date even when the profile hides it. GitHub's

https://api.github.com/users/<login>

returns a numeric

id

and

created_at

; Discord's snowflake IDs encode a creation timestamp directly. Per-platform detail: reference/platform-leakage.md.

Done when every candidate is graded confirmed, probable, or rejected, each with its evidence written next to it.

对于每个候选条目，寻找能让持怀疑态度的读者信服的证据。

强证据：

相同头像。使用
```
find-the-original-image
```
验证——如果匹配到库存照片或第三方图片，则排除该条目，而非确认。
字节完全相同或几乎相同的简介文本，尤其是包含跨平台一致的拼写错误或不常见表述。
自我声明的跨平台链接：个人资料链接到另一个平台的个人资料。这是除本人承认外最有力的证据。
两个账户存在相同的联系方式（同一邮箱、同一个人域名）。

中等证据：

跨平台的账户创建日期集中在一个狭窄的时间段内——人们会集中注册多个平台。
关注者/关注对象与相同的独特小众账户重叠。
写作风格：习语、标点习惯、发布内容的时区。

单独的弱证据：Handle匹配。这是你要验证的对象，而非证据。

暴露数字用户ID的平台格外有用。如果ID是按注册顺序分配的，即使个人资料隐藏了创建日期，ID也能确定账户的创建时间范围。GitHub的

https://api.github.com/users/<login>

会返回数字

id

和

created_at

；Discord的雪花ID直接编码了创建时间戳。各平台详细信息：reference/platform-leakage.md。

完成标志：每个候选条目都被标记为已确认、可能或已排除，并附上对应的证据。

Where this goes wrong

常见问题

Existence checks are HTTP heuristics. Every one of these produces a false positive:

Soft 404s. The site returns 200 with a "user not found" page. If the match rule keys on status code, everything exists.
Catch-all profile pages. Some platforms render a generic shell for any string and only 404 on the API.
Rate-limit and CAPTCHA interstitials. A challenge page is a 200 with body content, so it can satisfy both the "found" and "missing" rules — and once you are rate-limited, results for the rest of the run are garbage. Re-run failures separately rather than trusting a single sweep.
Reserved, squatted, and impersonation accounts. Registered, real, not your subject.
Stale entries. Sites change their 404 behaviour and detection lists lag. Absence of a hit is not absence of an account.

The deeper problem is collision. Common handles belong to many unrelated people, and a short or dictionary-word handle across ten platforms is ten people far more often than one. Confidence should scale with the handle's distinctiveness: a rare invented string is itself weak-to-moderate evidence,

mike

is none.

Do not resolve ambiguity by logging in, messaging, or requesting a follow. That is interaction, out of scope by default, and it tells the subject you exist — see

investigate-without-getting-made

存在性检查是基于HTTP的启发式判断。以下情况都会产生误报：

软404：网站返回200状态码，但显示“用户未找到”页面。如果匹配规则基于状态码，那么所有字符串都会被判定为存在。
通用个人资料页面：某些平台会为任何字符串生成通用的个人资料外壳，仅在API层面返回404。
速率限制与验证码拦截：挑战页面返回200状态码且包含内容，因此可能同时满足“存在”和“不存在”的规则——一旦被速率限制，后续运行的结果都会失效。单独重新运行失败的检查，而非信任单次扫描的结果。
保留、抢注和冒充账户：已注册的真实账户，但不属于你的调查对象。
过时条目：网站更改了404行为，但检测列表未更新。没有命中并不代表不存在账户。

更深层次的问题是冲突。常见的Handle属于许多无关的人，一个简短或字典词Handle出现在十个平台上，更可能对应十个人而非同一个人。置信度应与Handle的独特性成正比：一个罕见的自创字符串本身是弱到中等的证据，而

mike

则毫无价值。

不要通过登录、发消息或请求关注来解决歧义。这属于交互行为，默认超出范围，而且会让调查对象知道你的存在——参见

investigate-without-getting-made

。

Confidence grading

置信度分级

Confirmed — an avatar match verified through
```
find-the-original-image
```
plus one other strong item, or a self-declared cross-link between the two profiles, or a shared contact selector.
Probable — distinctive handle plus one moderate item (creation-date cluster, follower overlap, consistent style) and no contradicting evidence.
Unconfirmed — the handle matches and nothing else does. Report it as an enumeration hit, not as the subject's account.
Rejected — content, language, timeline, or avatar provenance contradicts the subject. Record rejections; they stop the next analyst redoing the work.

已确认 —— 通过
```
find-the-original-image
```
验证的头像匹配，加上另一项强证据；或两个个人资料之间的自我声明跨平台链接；或共享的联系方式。
可能 —— 独特的Handle加上一项中等证据（创建日期集中、关注者重叠、风格一致），且无矛盾证据。
未确认 —— Handle匹配，但无其他匹配项。将其报告为枚举命中，而非调查对象的账户。
已排除 —— 内容、语言、时间线或头像来源与调查对象矛盾。记录排除结果；这能避免后续分析师重复工作。

Worked example

实例演示

Given

sunfish_ada

. Sherlock returns 14 hits. maigret returns 9 with content, including a code-hosting profile with display name "A. Okonkwo", a photography site with the same avatar, and a forum with an empty shell profile.

The forum hit is discarded first: fetching a deliberately absurd handle on the same forum also returns 200 with an identical empty page. Catch-all, not an account.

The avatar on the photography site reverse-searches (via

find-the-original-image

) to the same image on the code-hosting profile and nowhere else — good. The code-hosting API gives a numeric ID and a creation date in the same month as the photography account's stated join date. Two moderate items plus an avatar match: confirmed for both.

A microblog hit with the same handle posts in a different language about unrelated subjects, on an account predating the others by six years. Different person, same string — rejected, and stated explicitly, because it is the first thing a reviewer will find.

给定

sunfish_ada

。Sherlock返回14个命中结果。maigret返回9个带内容的结果，包括一个代码托管平台的个人资料（显示名称为“A. Okonkwo”）、一个摄影网站的相同头像，以及一个论坛的空壳个人资料。

首先排除论坛的命中结果：在同一个论坛上查询一个故意编造的荒谬Handle，也会返回200状态码和相同的空页面。这是通用页面，而非真实账户。

摄影网站上的头像通过

find-the-original-image

反向搜索，发现与代码托管平台个人资料上的头像相同，且无其他来源——这是好证据。代码托管平台的API返回了数字ID和创建日期，与摄影账户声明的加入日期在同一个月。两项中等证据加上头像匹配：两个账户均已确认。

一个微博平台的相同Handle发布不同语言的无关内容，账户创建时间比其他账户早六年。这是不同的人使用相同的字符串——已排除，并明确记录，因为这是审阅者首先会发现的问题。

Pivots

线索拓展

New selector	Skill
Display name / real name	`find-anyone`
Exposed or inferred email	`what-an-email-reveals`
Phone number on a profile	`whose-number-is-this`
Avatar or posted photos	`find-the-original-image` , `secrets-in-file-metadata`
Photos with location context	`where-was-this-taken`
Code-hosting handle	`secrets-in-git-history`
Personal domain in a bio	`who-owns-this-domain`
Handle in credential dumps	`what-leaked-about-you`
Full posting history on a confirmed account	`pattern-of-life-from-socials`
The account map itself	`graph-the-network`

新选择器	技能
显示名称/真实姓名	`find-anyone`
暴露或推断的邮箱	`what-an-email-reveals`
个人资料中的电话号码	`whose-number-is-this`
头像或发布的照片	`find-the-original-image` , `secrets-in-file-metadata`
带位置信息的照片	`where-was-this-taken`
代码托管平台Handle	`secrets-in-git-history`
简介中的个人域名	`who-owns-this-domain`
凭证泄露中的Handle	`what-leaked-about-you`
已确认账户的完整发布历史	`pattern-of-life-from-socials`
账户关联图本身	`graph-the-network`

Legal and ToS notes

法律与服务条款说明

Automated enumeration hits platforms with scripted requests, which most terms of service prohibit regardless of the data being public. Keep concurrency low, do not defeat CAPTCHAs, and stop when a platform signals refusal. In the EU and UK, assembling scattered public accounts into a profile of a living person is processing personal data and needs a lawful basis and data minimisation.

自动化枚举会向平台发送脚本化请求，大多数服务条款都禁止这种行为，无论数据是否公开。保持低并发，不要绕过验证码，当平台发出拒绝信号时停止。在欧盟和英国，将分散的公共账户整合为活人的个人资料属于处理个人数据，需要合法依据并遵循数据最小化原则。

Step 5 — Report

步骤5 — 撰写报告

Run

write-the-intel-brief

. Give the platform/URL/confidence/evidence table, list rejections with reasons, and lead with the real-name and contact selectors the handles produced.

Done when every candidate in the table carries a grade and a source, and no enumeration hit appears without one.

运行

write-the-intel-brief

。提供平台/URL/置信度/证据表格，列出带原因的排除结果，并以Handle推导得出的真实姓名和联系方式作为开头。

完成标志：表格中的每个候选条目都带有分级和来源，所有枚举命中结果均附带分级。