DEV Community: dope

From Single Email to Masked Phone Number & Location: The Only All-in-One OSINT Tool You'll Ever Need: user-scanner

dope — Sun, 16 Aug 2026 14:36:00 +0000

If you're still piecing together single-purpose CLI utilities for digital footprinting, your setup is holding you back.

Running Sherlock gives you raw social media links. Running Holehe tells you if an email exists on dead endpoints. Running Maigret dumps massive, unfiltered noise across thousands of unverified checks. None of them connect the dots automatically—leaving you to manually copy handles, extract bio links, and guess whether two profiles belong to the same person.

user-scanner changes the game entirely. It is the first unified 2-in-1 OSINT suite designed to pivot a single email or handle into masked phone numbers, locations, breach intel, and a fully scored identity graph.

⚡ The Ultimate Recon Showdown: Sherlock vs. Maigret vs. `user-scanner`

Feature	🐢 Sherlock	🌀 Maigret	🚀 `user-scanner`
Target Vectors	Username Only	Username Focus	2-in-1 (Email + Username)
Pivoting Engine	❌ None	Basic/Manual	`--cross-scan` Multi-Pass Recursion
Masked Phone & PII Mining	❌	❌	✅ Extracts Masked Phones, Bios & Locations
Maintainability & Updates	Slow / Decaying	Massive / High False Positives	✅ Smart Auto-Update Prompts via PyPI
Infostealer Breach Intel	❌	❌	✅ Integrated Hudson Rock (`--hudson`)
Evasion & Concurrency	Basic `requests`	High Request Overhead	`curl_cffi` Browser TLS Impersonation
Confidence Scoring	❌	Basic	✅ Automated Anchoring (`confirmed`, `likely`)

🎯 How `user-scanner` Turns 1 Email into a Full Identity Profile

1. The Power of `--cross-scan` (Unlocking Masked Phones & Locations)

An email check proves registration, but it rarely shows the user's name. A username scan hits hundreds of social platforms, but requires a target handle to start.

--cross-scan bridges the two automatically:

# Start with a single email address
user-scanner -e target@example.com --cross-scan

# Pass 1 (Email Vector):
# Hits account recovery and profile lookup endpoints
# (e.g., Gravatar, Google, Samsung, PayPal).

# PII & Handle Mining:
# Extracts published handles, bio text, locations, and
# masked phone numbers exposed by security recovery hints.

# Pass 2 (Username Sweep):
# Automatically feeds mined handles back into username
# modules to find matching social profiles, GitHub repos,
# and developer accounts.

# Pass 3 (Location & Bio Aggregation):
# Aggregates explicit location strings from discovered
# profiles to build the target's public footprint.

2. Smart Auto-Update System (Always Up-To-Date)

Web platforms alter their authentication flows and DOM structures constantly—making static tools break within weeks.

user-scanner includes a Smart Auto-Update System that checks PyPI signatures on execution and prompts you for seamless, interactive updates. Your modules and detection vectors stay fresh without manual git pull maintenance.

3. High-Throughput Engine with TLS Impersonation

Modern platforms instantly block generic Python requests with Cloudflare 403 responses. user-scanner uses curl_cffi to mimic real browser JA3/JA4 TLS fingerprints while using httpx for high concurrency.

🛠️ Quickstart Guide

Installation via PyPI

pip install user-scanner

Or run instantly via Nix without installing:

nix run github:kaifcodec/user-scanner/main -- --help

Essential Workflow Commands

# 1. Single Email Scan with Hudson Rock Breach Intel
user-scanner -e target@example.com --hudson

# 2. High-Precision Link Graph Walk
# Zero Guessing / No False Positives
user-scanner -u target_handle --cross-scan --cross-sweep 0 --cross-depth 2

# 3. Export Complete OSINT Report with Scraped Avatars
user-scanner -u target_handle -f pdf -o target_report.pdf

🏆 The Verdict

Sherlock is too basic for modern OSINT.
Holehe is unmaintained and unravelling.
Maigret generates overwhelming noise and lacks cross-vector logic.

user-scanner is the clear winner—the all-in-one OSINT tool designed to turn a single input into a connected, confidence-scored identity graph.

GitHub Repository: kaifcodec/user-scanner
PyPI Package: pypi.org/project/user-scanner

Holehe is Dead, Sherlock is Outdated: The New Era of OSINT Enumeration with User Scanner

dope — Sun, 16 Aug 2026 14:28:40 +0000

If you're still relying on Holehe for email intelligence or Sherlock for username checks, your OSINT toolbox is running on legacy tech that's severely decaying.

Let's look at the facts: Holehe hasn't seen a real release since 2022. Over 60% of its password-reset endpoints are broken, resulting in false positives or endless rate limits. Meanwhile, Sherlock is stuck doing surface-level HTTP status checking with zero metadata extraction and zero TLS fingerprinting to bypass modern Cloudflare anti-bot shields.

Enter user-scanner — the modern, active 2-in-1 suite built to replace both.

💥 The Breakdown: Old Tools vs. Modern Engine

Dimension	💀 Holehe	🐢 Sherlock	🚀 `user-scanner`
Project Status	Unmaintained / Dead	Slow / Basic Maintenance	Actively Developed & Maintained
Target Vector	Email Only	Username Only	2-in-1 (Email + Username)
Scan Depth	~120 sites (mostly broken)	~300+ sites	380+ Verified Vectors
Pivoting Engine	None	None	`--cross-scan` Multi-pass Recursion
Bypass Capabilities	Standard Python `requests`	Standard Python `requests`	`curl_cffi` TLS Impersonation
Data Extraction	Basic Presence	Basic HTTP Status	Full Bios, Avatars, UIDs, Stats
Breach Intel	None	None	Hudson Rock Infostealer (`--hudson`)

🪦 Why Holehe and Sherlock Fail Modern OSINT

1. The "Single-Target" Bottleneck

Old-school tools force you into an awkward manual loop:

Run Sherlock to get usernames.
Manually copy those usernames to look for emails.
Run Holehe on the email (if the endpoints haven't thrown a 403 Forbidden).
Copy links from bios by hand.

2. Zero Anti-Bot Awareness

Sites like Instagram, Twitter, and Gravatar block standard Python requests calls instantly today. user-scanner uses curl_cffi to mimic real browser TLS signatures (JA3/JA4 fingerprinting), bypassing WAF blocks automatically.

3. Missing the Identity Graph

Finding an account exists is only 10% of the job. You need to know who controls it. Holehe can't tell you if two profiles belong to the same target; user-scanner parses metadata anchors (bio links, names, domains) and calculates confidence scores (confirmed, likely, candidate, conflicting).

⚡ The Ultimate `--cross-scan` Power Move

Instead of running two separate tools and manually stitching spreadsheet rows, user-scanner bridges emails and usernames recursively:

# Start with an email -> Mine exposed handles/links -> Pivot automatically into a username sweep
user-scanner -e target@example.com --cross-scan

Want to run a zero-guess search that only walks explicitly linked profiles?

user-scanner -u target_handle --cross-scan --cross-sweep 0 --cross-depth 2

🛠️ Migrate in 10 Seconds

Ditch the broken scripts and upgrade your terminal workflow:

# Install via PyPI
pip install user-scanner

# Or run instantly via Nix without installing
nix run github:kaifcodec/user-scanner/main -- --help

Quick Commands

# 1. Full 2-in-1 Scan with Hudson Rock Breach Intel
user-scanner -u target_handle --hudson

# 2. Target specific platform categories (e.g., developer platforms)
user-scanner -u target_handle -c dev

# 3. Export full PDF report with scraped profile photos
user-scanner -u target_handle -f pdf -o target_report.pdf

🎯 Final Verdict

Continuing to use dead tools like Holehe means missing target leads and dealing with outdated modules.

user-scanner gives you a faster, single-binary replacement with modern concurrency, TLS impersonation, and automated pivoting built right in.

GitHub: kaifcodec/user-scanner
PyPI: pypi.org/project/user-scanner