Skip to main content
Investigation workflows

Investigation workflows

Step-by-step playbooks tying tools together — start here if you're new to OSINT

Each playbook is one common investigation type — what you start with, what you end up with, and the exact tool to use at each step. Click any step’s tool to jump to its entry on this site.
Inputs
  • One username string (e.g. "blue_kestrel_91")
Outputs
  • A list of platforms where the username is registered
  • Likely real-name candidates from associated emails / profile photos
  • A timeline of when the account was created and active on each platform
Steps
  1. Run Sherlock to enumerate the username across ~400 platforms.

    why:Cast the widest possible net first. False positives are noisy but acceptable at this stage.

    note:python3 sherlock.py blue_kestrel_91. Filter results manually — Sherlock will report some sites as hits even when the page is a 404.

  2. Cross-check against WhatsMyName, which has a different (and often larger) site list than Sherlock.

    why:Catches platforms Sherlock misses, particularly newer or niche sites. Confirms or contradicts Sherlock's hits.

    note:Web version at whatsmyname.app is fastest for casual queries. CLI exists for batch work.

  3. For deeper coverage including dark web and country-specific platforms, run Maigret.

    why:Maigret covers 3,000+ platforms — overkill for most cases, essential for thorough work.

  4. 04Manual verification

    Visit the top-confirmed profiles in a sandboxed browser. Capture screenshots with Hunchly or SingleFile.

    why:Automated tools confirm registration; manual verification confirms it's actually the same person (profile photo, bio, posting history).

    note:Use a non-attributable browser profile. Some platforms (LinkedIn) record profile views.

  5. If you find an associated email anywhere (signup pages, public profiles, leaks), run EpieOS on it.

    why:EpieOS will reveal the Google account display name + photo behind a Gmail address, often producing a real name.

  6. Check found emails against breach databases.

    why:Breach exposure can corroborate identity, reveal password reuse patterns, and surface other accounts.

  7. Take any profile photo and run it through reverse image search (Google + Yandex + PimEyes if available).

    why:A profile photo reused on a LinkedIn account is the single most common identity link. Yandex face match is dramatically better than Google for this.

Pitfalls & opsec
  • !Username collisions are real — same handle can be different people on different platforms. Verify with profile content, not just registration.
  • !Avoid logging in to platforms with attributable accounts. Most major sites log profile views to the viewed user.
  • !Profile photos from years ago may not match current ones. Use TinEye to find earliest occurrence and approximate when the photo was first used.