Checking Your Own Public Footprint Part 3: What a Username Reveals, and How to Check It Safely

16 August 2026 SecurityOSINTPrivacyKaliMaigret

A domain record exposes you if you own domains. A username exposes you everywhere you’ve reused it, which for most people is a much longer list. This part covers Maigret, a username-search tool that ships on Kali and installs cleanly with pip anywhere else, and I’m demonstrating it the only way that’s appropriate for a post like this: against a decoy identity, invented specifically for this post, that I’ve never used to register anything, anywhere.

Building a decoy, not borrowing one

The identity used below is the string GraniteFalcon9273Test, generated for this post and this post only. It is not, and has never been, a handle I’ve used on any real service. That distinction matters for what the result below actually demonstrates: any hit this string returns cannot be a genuine account, because nobody has ever created one under it. Which makes it a useful way to show exactly how much a raw “match” is worth on its own.

Running it

$ maigret GraniteFalcon9273Test --top-sites 200 --timeout 8

Maigret works by checking a username against a maintained, regularly updated database of site URL patterns, currently over 3,000 of them, and reporting back which ones return a profile-shaped response. No API keys, no accounts, no rate-limit negotiation. --top-sites 200 scopes the run to the 200 most-relevant sites in its database rather than the full catalogue, which is the right call for a quick check; the full -a run is thorough but takes a lot longer.

The real run against the decoy above checked 210 sites and came back with:

Search by username GraniteFalcon9273Test returned 1 accounts.
[+] ChaturBate: https://chaturbate.com/GraniteFalcon9273Test/

One match. Against a username that was typed into a terminal for the first time thirty seconds before the scan ran. That is not a real account existing. It’s a false positive, and the mechanism is usually the same one that trips up every tool in this category: a site returns HTTP 200 for a profile URL regardless of whether the profile exists, sometimes serving a generic “create this page” or search-results page at a URL shape that looks, to an automated checker, exactly like a hit.

I’ve run into this before, from the other direction. My Kali 2026.2 tools review tested tookie-osint, a similar Sherlock-style checker, against a different invented username and found its own advertised accuracy claim didn’t hold up under a live run. Two different tools in the same category, tested the same way, months apart: both produced at least one result that couldn’t possibly be real. That’s not a knock on either specific tool. It’s the category. Anything that checks hundreds or thousands of URL patterns automatically is going to have a false-positive rate, and the only way to know if a hit is real is to open the link and look.

Maigret’s own run output is honest about this in a different way. It logged its own error classes alongside the result:

[!] Too many errors of type "Bot protection" (4.76%). Try to switch to another ip address
[!] Too many errors of type "Access denied" (3.81%). It's recommended to use --cloudflare-bypass or a proxy

Roughly one site in twelve returned an ambiguous result, neither a clean hit nor a clean miss, because the site itself blocked the automated request. Those don’t show up in the “1 accounts” summary line at all. A quick scan’s headline number is a floor, not a complete picture, in both directions: it can overcount (the ChaturBate result) and it can undercount (anything hidden behind the errors above).

Reading a real run against your own handle

Run it against a username you’ve actually used, ideally one you’ve reused across more than one service, and treat every result as a lead rather than a fact:

  1. Open every link it reports. A dead or generic landing page at that URL is not confirmation.
  2. Check the profile content, not just the URL. Does it show information that’s actually yours: a bio, a post history, a profile photo you recognise?
  3. Note which services you’d forgotten you ever signed up for. This is usually the most useful part of the exercise, independent of anything Maigret gets wrong.
  4. For anything genuinely stale or abandoned, that’s a deletion candidate, covered in Part 6.

Maigret also supports --site SITE_NAME to check one platform at a time and --print-errors to see exactly which sites it couldn’t reach, both worth using once the broad scan has narrowed down what’s worth a closer look.

Part 4 moves from accounts to code: what a secret scanner finds when it’s pointed at your own public repositories, and what’s quietly sitting in a file’s metadata.