hunt-a-handle

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Hunt a handle

账号名调查

Handle reuse is the cheapest strong link in OSINT: one string, checked in minutes, potentially tying a dozen platforms to one person. It is also the most over-trusted. Enumerators do not verify identity — they perform HTTP existence checks — and a hit list is a list of candidates, nothing more. The mistake that ruins these investigations is pasting the tool's output into the report. Enumeration is the cheap half; confirmation is the work.

账号名复用是OSINT中成本最低的强关联线索：只需一个字符串，几分钟就能完成核查，有可能将十几个平台的账户关联到同一个人身上。但它也是最被过度信任的线索。枚举工具不会验证身份——它们只是执行HTTP存在性检查——命中列表只不过是一份候选账户清单而已。毁掉这类调查的错误做法就是直接把工具输出粘贴到报告里。枚举是成本低廉的前半部分；确认身份才是核心工作。

Step 1 — Authorized scope

步骤1 — 授权范围

Read ../../ETHICS.md and write down, before any query: subject, objective, in-bounds selectors, out-of-bounds actions (logging in, contacting, requesting follows), and the governing jurisdiction. Handle hunting drifts easily — one run hands you thirty new platforms, and it is trivial to end up profiling an uninvolved person who shares the string.

Done when scope is written down and you can name what would put you out of bounds.

阅读../../ETHICS.md，并在执行任何查询前记录以下内容：调查对象、目标、可使用的调查线索、禁止行为（登录、联系、请求关注）以及管辖司法辖区。账号名调查很容易偏离范围——一次运行就能给你三十个新平台，很容易最后却调查到了一个共用该账号名的无关人员。

完成标准：已记录调查范围，且你能明确说明哪些行为属于越界。

Step 2 — Pick your enumerator

步骤2 — 选择枚举工具

Holding	Reach for	Why
One handle, need breadth fast	`sherlock`	Largest quick sweep, existence only
One handle, need profile content	`maigret`	Parses the page: display name, bio, IDs, links, sometimes country and creation date
Need to see why a hit fired	WhatsMyName data	Every check is a declared URI plus a match rule you can read
A handle on one known platform	Manual visit	Nothing beats reading the actual profile

bash

sherlock jdoe_92 --timeout 10 --csv
maigret jdoe_92 --html

maigret is the higher-value tool for correlation because it returns fields, not booleans. A display name, avatar URL, self-declared location, numeric user ID and an "also known as" list give you material to test the next platform against. Sherlock gives you a URL and a claim.

WhatsMyName is a detection list, not a scanner: a JSON file of site entries, each with a URI template and explicit match criteria (an expected HTTP status and an expected string in the body, plus the equivalent for "missing"). Read the entry for any site you doubt — it tells you exactly what the tool considered proof. Many wrappers and web front-ends consume the same list, so a hit in three different tools is often one rule firing three times, not three independent confirmations.

Done when every candidate is recorded with platform, URL, the tool that found it, and live/dead status.

场景	选用工具	原因
单个账号名，需要快速覆盖大范围	`sherlock`	快速扫描范围最广，仅检查账户是否存在
单个账号名，需要获取个人资料内容	`maigret`	可解析页面内容：显示名、简介、ID、链接，有时还能获取国家和创建日期
需要了解命中原因	WhatsMyName 数据	每项检查都有公开的URI和可查阅的匹配规则
已知某平台上的一个账号名	手动访问	没有什么比直接查看真实资料更可靠

bash

sherlock jdoe_92 --timeout 10 --csv
maigret jdoe_92 --html

maigret是更适合做关联分析的高价值工具，因为它返回的是字段信息，而非布尔值。显示名、头像URL、自行声明的位置、数字用户ID以及“又名”列表，这些都能为你核查下一个平台提供依据。而sherlock只会返回URL和存在性声明。

WhatsMyName是一个检测列表而非扫描器：它是一个包含站点条目的JSON文件，每个条目都有URI模板和明确的匹配规则（预期HTTP状态码、响应体中的预期字符串，以及对应的“不存在”判定规则）。你可以查阅任何存疑站点的条目——它会明确告诉你工具将什么视为命中依据。许多封装工具和Web前端都使用同一个列表，因此在三个不同工具中都命中，往往只是同一条规则触发了三次，而非三次独立的确认。

完成标准：所有候选账户都已记录，包含所属平台、URL、发现它的工具以及有效/无效状态。

Step 3 — Generate variants

步骤3 — 生成变体

The handle you were given is one point in a person's naming habit. Recover the habit and you find the accounts the first sweep missed.

Separator swaps:
```
john.doe
```
,
```
john_doe
```
,
```
john-doe
```
,
```
johndoe
```
Truncations and initials:
```
jdoe
```
,
```
johnd
```
,
```
j_doe
```
,
```
doej
```
Number suffixes: birth year, birth year two-digit,
```
1
```
,
```
99
```
,
```
007
```
Leetspeak and character substitution:
```
j0hnd0e
```
,
```
johnd0e
```
Email local part as handle, and handle as email local part
Gamer-tag morphology: prefixes,
```
xX…Xx
```
, clan tags, doubled letters

Full pattern list: reference/variant-patterns.md.

Two inference directions matter. Handle → name:

jdoe_92

suggests a first-initial-lastname pattern and a 1992 birth year, which is a hypothesis to test, not a finding. Name → handle: if you already have a real name, generate the handles that name would plausibly produce and enumerate those too — it often outperforms starting from a handle someone gave you.

Done when the variant set is enumerated and the ones that produced hits are folded back into Step 2.

你拿到的账号名只是一个人命名习惯中的一个点。摸清其命名习惯，就能找到第一轮扫描漏掉的账户。

分隔符替换：
```
john.doe
```
、
```
john_doe
```
、
```
john-doe
```
、
```
johndoe
```
截断与首字母缩写：
```
jdoe
```
、
```
johnd
```
、
```
j_doe
```
、
```
doej
```
数字后缀：出生年份、两位出生年份、
```
1
```
、
```
99
```
、
```
007
```
黑客语与字符替换：
```
j0hnd0e
```
、
```
johnd0e
```
邮箱本地部分作为账号名，以及账号名作为邮箱本地部分
玩家标签形态：前缀、
```
xX…Xx
```
、战队标签、重复字母

完整模式列表：reference/variant-patterns.md。

有两个推理方向很重要。账号名→姓名：

jdoe_92

暗示了“首字母+姓氏”的命名模式和1992年的出生年份，这是一个需要验证的假设，而非结论。姓名→账号名：如果你已经掌握了真实姓名，可以生成该姓名可能对应的账号名并进行枚举——这种方法的效果往往优于从别人给你的某个账号名开始调查。

完成标准：已完成变体集合的枚举，且将产生命中的变体重新纳入步骤2的调查中。

Step 4 — Confirm, or reject

步骤4 — 确认或排除

For each candidate, look for evidence that survives a skeptical reader.

Strong:

Same avatar. Verify with
```
find-the-original-image
```
— a match to a stock photo or a third party's picture is a rejection, not a confirmation.
Byte-identical or near-identical bio text, especially with a typo or an unusual phrasing carried across.
A self-declared cross-link: the profile links the other profile. Best evidence available short of an admission.
A contact selector present on both (same email, same personal domain).

Moderate:

Account creation dates clustering in a narrow window across platforms — people sign up for things in bursts.
Follower/following overlap with the same distinctive small accounts.
Writing style: idiom, punctuation habits, timezone of posting.

Weak on its own: the handle matching. That is the thing you are testing, not evidence for it.

Platforms exposing a numeric user ID are disproportionately useful. Where IDs are issued in registration order, the ID bounds an account's creation date even when the profile hides it. GitHub's

https://api.github.com/users/<login>

returns a numeric

id

and

created_at

; Discord's snowflake IDs encode a creation timestamp directly. Per-platform detail: reference/platform-leakage.md.

Done when every candidate is graded confirmed, probable, or rejected, each with its evidence written next to it.

对于每个候选账户，寻找能经得住质疑的证据。

强证据：

相同头像。使用
```
find-the-original-image
```
验证——如果匹配到库存图片或第三方的照片，则属于排除证据，而非确认证据。
字节完全相同或高度相似的简介文本，尤其是带有相同的拼写错误或不寻常表述的情况。
自行声明的交叉链接：个人资料中链接了另一个账户的资料。这是除当事人承认之外最有力的证据。
两个账户存在共同的联系方式（相同邮箱、相同个人域名）。

中等证据：

跨平台的账户创建日期集中在很短的时间范围内——人们通常会集中注册一批服务。
粉丝/关注列表与相同的小众特色账户存在重叠。
写作风格：习语、标点使用习惯、发帖时区。

本身属于弱证据：账号名匹配。这是你要验证的对象，而非验证的证据。

暴露数字用户ID的平台价值格外高。在ID按注册顺序发放的平台，即使个人资料隐藏了创建日期，ID也能框定账户的创建时间范围。GitHub的

https://api.github.com/users/<login>

会返回数字

id

和

created_at

；Discord的雪花ID直接编码了创建时间戳。各平台的详细信息：reference/platform-leakage.md。

完成标准：所有候选账户都已被评定为已确认、可能或已排除，且每个评定都附有对应的证据。

Where this goes wrong

常见问题

Existence checks are HTTP heuristics. Every one of these produces a false positive:

Soft 404s. The site returns 200 with a "user not found" page. If the match rule keys on status code, everything exists.
Catch-all profile pages. Some platforms render a generic shell for any string and only 404 on the API.
Rate-limit and CAPTCHA interstitials. A challenge page is a 200 with body content, so it can satisfy both the "found" and "missing" rules — and once you are rate-limited, results for the rest of the run are garbage. Re-run failures separately rather than trusting a single sweep.
Reserved, squatted, and impersonation accounts. Registered, real, not your subject.
Stale entries. Sites change their 404 behaviour and detection lists lag. Absence of a hit is not absence of an account.

The deeper problem is collision. Common handles belong to many unrelated people, and a short or dictionary-word handle across ten platforms is ten people far more often than one. Confidence should scale with the handle's distinctiveness: a rare invented string is itself weak-to-moderate evidence,

mike

is none.

Do not resolve ambiguity by logging in, messaging, or requesting a follow. That is interaction, out of scope by default, and it tells the subject you exist — see

investigate-without-getting-made

存在性检查是基于HTTP的启发式方法。以下情况都会产生误报：

软404。 站点返回200状态码，但页面内容是“用户未找到”。如果匹配规则以状态码为依据，那么所有账户都会被判定为存在。
通用资料页。 有些平台对任何字符串都会渲染一个通用外壳页面，只有API才会返回404。
速率限制与CAPTCHA插页。 验证页面是200状态码且有响应体内容，因此可能同时满足“存在”和“不存在”的规则——而且一旦被限流，后续运行的结果都是无效的。应单独重新运行失败的检查，而非信任单次扫描结果。
保留号、抢注号和仿冒账户。 这些都是已注册的真实账户，但不属于你的调查对象。
过时条目。 站点会更改其404行为，而检测列表存在滞后性。未命中不代表账户不存在。

更深层的问题是重名。常见的账号名属于很多互不相关的人，一个由短词或字典单词组成的账号名在十个平台上出现，十有八九是十个不同的人，而非同一个人。置信度应与账号名的独特性成正比：一个罕见的自创字符串本身属于弱到中等强度的证据，而

mike

这类名字则完全没有证据效力。

不要通过登录、发消息或请求关注来解决歧义。这属于互动行为，默认超出调查范围，而且会让调查对象发现你的存在——参见

investigate-without-getting-made

。

Confidence grading

置信度分级

Confirmed — an avatar match verified through
```
find-the-original-image
```
plus one other strong item, or a self-declared cross-link between the two profiles, or a shared contact selector.
Probable — distinctive handle plus one moderate item (creation-date cluster, follower overlap, consistent style) and no contradicting evidence.
Unconfirmed — the handle matches and nothing else does. Report it as an enumeration hit, not as the subject's account.
Rejected — content, language, timeline, or avatar provenance contradicts the subject. Record rejections; they stop the next analyst redoing the work.

已确认 — 通过
```
find-the-original-image
```
验证的头像匹配加上另一项强证据，或两个个人资料之间自行声明的交叉链接，或共享的联系方式。
可能 — 独特的账号名加上一项中等证据（创建日期集中、粉丝重叠、风格一致），且无矛盾证据。
未确认 — 仅账号名匹配，无其他匹配项。将其报告为枚举命中，而非调查对象的账户。
已排除 — 内容、语言、时间线或头像来源与调查对象矛盾。记录排除结果；这样可以避免下一位分析师重复工作。

Worked example

示例

Given

sunfish_ada

. Sherlock returns 14 hits. maigret returns 9 with content, including a code-hosting profile with display name "A. Okonkwo", a photography site with the same avatar, and a forum with an empty shell profile.

The forum hit is discarded first: fetching a deliberately absurd handle on the same forum also returns 200 with an identical empty page. Catch-all, not an account.

The avatar on the photography site reverse-searches (via

find-the-original-image

) to the same image on the code-hosting profile and nowhere else — good. The code-hosting API gives a numeric ID and a creation date in the same month as the photography account's stated join date. Two moderate items plus an avatar match: confirmed for both.

A microblog hit with the same handle posts in a different language about unrelated subjects, on an account predating the others by six years. Different person, same string — rejected, and stated explicitly, because it is the first thing a reviewer will find.

给定账号名

sunfish_ada

。sherlock返回14个命中结果。maigret返回9个带内容的结果，包括一个显示名为“A. Okonkwo”的代码托管平台资料、一个头像相同的摄影网站资料，以及一个空壳资料的论坛账户。

论坛的命中结果首先被排除：在同一个论坛上搜索一个刻意编造的荒谬账号名，也会返回200状态码和完全相同的空页面。这是通用页面，而非真实账户。

摄影网站的头像（通过

find-the-original-image

）反向搜索后，只在代码托管平台的资料中找到相同图片，其他地方没有——这是好迹象。代码托管平台的API返回了数字ID，其创建日期与摄影账户声明的加入日期在同一个月。两项中等证据加上头像匹配：两个账户均被确认为同一人所有。

一个同名的微博命中结果使用不同语言发布无关主题的内容，且账户创建时间比其他账户早六年。属于不同的人，只是账号名相同——予以排除，并明确说明，因为这是审核者首先会发现的内容。

Pivots

线索拓展

New selector	Skill
Display name / real name	`find-anyone`
Exposed or inferred email	`what-an-email-reveals`
Phone number on a profile	`whose-number-is-this`
Avatar or posted photos	`find-the-original-image` , `secrets-in-file-metadata`
Photos with location context	`where-was-this-taken`
Code-hosting handle	`secrets-in-git-history`
Personal domain in a bio	`who-owns-this-domain`
Handle in credential dumps	`what-leaked-about-you`
Full posting history on a confirmed account	`pattern-of-life-from-socials`
The account map itself	`graph-the-network`

新的调查线索	对应技能
显示名 / 真实姓名	`find-anyone`
暴露或推断出的邮箱	`what-an-email-reveals`
个人资料中的电话号码	`whose-number-is-this`
头像或发布的照片	`find-the-original-image` 、 `secrets-in-file-metadata`
带有位置信息的照片	`where-was-this-taken`
代码托管平台账号名	`secrets-in-git-history`
简介中的个人域名	`who-owns-this-domain`
凭证泄露库中的账号名	`what-leaked-about-you`
已确认账户的完整发布历史	`pattern-of-life-from-socials`
账户关系图本身	`graph-the-network`

Legal and ToS notes

法律与服务条款注意事项

Automated enumeration hits platforms with scripted requests, which most terms of service prohibit regardless of the data being public. Keep concurrency low, do not defeat CAPTCHAs, and stop when a platform signals refusal. In the EU and UK, assembling scattered public accounts into a profile of a living person is processing personal data and needs a lawful basis and data minimisation.

自动枚举会向平台发送脚本化请求，无论数据是否公开，大多数服务条款都禁止这种行为。请保持低并发，不要绕过CAPTCHA，当平台发出拒绝信号时立即停止。在欧盟和英国，将分散的公开账户整合为一个在世人员的资料属于个人数据处理，需要有合法依据并遵循数据最小化原则。

Step 5 — Report

步骤5 — 报告

Run

write-the-intel-brief

. Give the platform/URL/confidence/evidence table, list rejections with reasons, and lead with the real-name and contact selectors the handles produced.

Done when every candidate in the table carries a grade and a source, and no enumeration hit appears without one.

运行

write-the-intel-brief

。提供包含平台/URL/置信度/证据的表格，列出排除结果及原因，并将账号名调查得出的真实姓名和联系方式放在开头。

完成标准：表格中的每个候选账户都有等级和来源，所有枚举命中结果都附有对应信息。