DEV Community: Hadfy

Why You Need to Ditch Sherlock and Holehe for This 2-in-1 OSINT Suite—user-scanner

Hadfy — Sat, 15 Aug 2026 11:24:54 +0000

If you've spent any time doing digital footprinting or target enumeration, your workflow probably looks like this:

Fire up Sherlock to see where a handle exists across social media.
Realize Sherlock doesn't extract metadata or verify email registrations.
Switch over to Holehe to run an email check against recovery endpoints.
Manually copy-paste discovered handles or links into a second search.
Deal with endless rate limits, missing profile photos, and outdated modules.

It's fragmented, slow, and full of friction. user-scanner replaces both legacy utilities with a unified engine while adding automated target pivoting and breach intel correlation.

⚡ Quick Comparison

Feature	Sherlock	Holehe	`user-scanner`
Scan Vector Support	Username Only	Email Only	2-in-1 (Username + Email)
Active Vectors	~300+	~120+	380+ Combined
Metadata Extraction	❌ (URL checking)	❌ (Basic presence)	✅ Avatars, UIDs, Bios, Stats
Recursive Pivot Engine	❌	❌	✅ `--cross-scan` (Multi-pass)
Infostealer Intel	❌	❌	✅ Hudson Rock (`--hudson`)
TLS Impersonation	Basic Requests	Standard Requests	`curl_cffi` + `httpx` Concurrency
Export Formats	TXT / CSV	Console	PDF (w/ photos), JSON, CSV

🚀 What Makes `user-scanner` Different?

1. The `--cross-scan` Engine (Automated Recursive Pivoting)

An email check tells you if an account exists on a site, but it rarely reveals the user's name or handle. A username scan hits far more sites, but requires a target handle to start.

--cross-scan bridges the two automatically:

# Run initial email scan -> extract exposed handles/links -> automatically sweep discovered handles
user-scanner -e target@example.com --cross-scan

It extracts handles, links, and secondary email addresses straight out of profile bios and metadata, automatically classifying link trust (handle, verified, link) and rating hit confidence (confirmed, likely, candidate, conflicting).

You can even restrict recursion depth to execute cheap, high-precision searches without guessing:

user-scanner -u target --cross-scan --cross-sweep 0 --cross-depth 2

2. Deep Metadata Scraping

Instead of just returning a binary Found / Not Found, user-scanner extracts actionable intel:

Profile avatars & header images (embedded directly into exported PDF reports)
Account UIDs, follower/following counts, and seller statuses
Bio links and unparsed text signatures

3. Integrated Infostealer Malware Logs

Cross-reference your target against global infostealer malware infection logs, powered by Hudson Rock, in the same run:

user-scanner -u target_handle --hudson

🛠️ Quickstart

Installation via PyPI

pip install user-scanner

Or run instantly via Nix without installing:

nix run github:kaifcodec/user-scanner/main -- --help

Common Commands

# Single target username scan
user-scanner -u johndoe

# Single target email scan
user-scanner -e johndoe@gmail.com

# Target developer platform modules only
user-scanner -u johndoe -c dev

# Proxy rotation with pre-scan health validation
user-scanner -u johndoe -P proxies.txt --validate-proxies

# Export formatted report to PDF with scraped avatars
user-scanner -u johndoe -f pdf -o target_report.pdf

🐍 Python Library Mode

If you're building custom automation pipelines or security agents, you can call the engine directly from Python:

import asyncio

from user_scanner.core import engine
from user_scanner.email_scan.shopping import etsy


async def main():
    result = await engine.check(etsy, "target@gmail.com")
    print(result.to_json())


asyncio.run(main())

🔗 Try It Out

Stop juggling multiple outdated CLI tools for basic reconnaissance. Grab the project on GitHub, drop a ⭐ if it speeds up your workflow, and start mapping digital footprints in seconds.

GitHub Repository: kaifcodec/user-scanner
PyPI Package: user-scanner

Tool Spotlight: Advanced Digital Footprinting with user-scanner (2026 OSINT Workflow)

Hadfy — Thu, 13 Aug 2026 19:11:42 +0000

In threat intelligence and adversary emulation, initial reconnaissance usually means spending half your time jumping between single-purpose account checkers. If you're still relying solely on legacy utilities like Holehe or Sherlock, you're likely running into rate-limiting walls and missing crucial linked identities.

I recently tested user-scanner, an open-source 2-in-1 Python OSINT engine that unifies email registration checking, username profiling, and recursive pivoting into a single workflow.

Here is my breakdown of how it stacks up and how to use it for fast target correlation.

Technical Comparison Matrix

Core Feature / Parameter	Holehe	Sherlock / Maigret	`user-scanner`
Input Supported	Email Only	Username Only	2-in-1 (Email & Username)
Module Coverage	~120 Email Endpoints	Scrapes Public Web Forms	380+ Vectors (155+ Email / 225+ Username)
Automated Pivot Chain	❌ No	❌ No	✅ `--cross-scan` Engine (Multi-Hop)
Infostealer Context	❌ No	❌ No	✅ Hudson Rock Breach API (`--hudson`)
Request Engine	Basic Async	Standard Requests	`httpx` + `curl_cffi` (TLS Fingerprinting)
Export Options	Standard Output / JSON	`.txt` / `.csv`	PDF (with Profile Media), JSON, CSV
Deployment Options	Pip	Pip	Pip, Virtual Environment, Nix (`nix run`)

Why `user-scanner` Fits Modern Investigations

1. Multi-Hop Pivot & Cross-Scanning (`--cross-scan`)

Instead of giving you a simple boolean hit and stopping, user-scanner acts as a correlation engine. It parses the metadata returned during initial execution—such as public bios, secondary handles, and exposed contact emails—and automatically launches secondary scans across matching platform modules.

Pivot Email → Username: Extracts handles or social profiles advertised on registered email profiles.
Pivot Username → Email: Mines public email addresses exposed on social profile pages.
Controlled Depth: Use --cross-depth to specify how many rounds of link-following to execute, paired with --cross-links verified for platform-verified hits.

2. Built-in Infostealer Intelligence (`--hudson`)

Pass the --hudson flag alongside any email or username scan to query Hudson Rock’s infostealer database. This immediately flags whether your target appears in compromised credential logs exfiltrated by malware.

3. High-Throughput Engine & WAF Evasion

Under the hood, user-scanner pairs httpx with curl_cffi to execute automated TLS fingerprint impersonation. This bypasses basic WAF blocks and edge restrictions without triggering loud rate-limits. It also supports http and socks5 proxy lists (-P) with pre-scan health checks (--validate-proxies).

Quick Reference CLI Commands

1. Target Reconnaissance & Deep Pivoting

# Standard email registration check
user-scanner -e target@domain.com

# Deep pivot scan: extract handles & secondary emails up to 2 hops deep
user-scanner -e target@domain.com --cross-scan --cross-depth 2

# Username scan with Infostealer Breach correlation
user-scanner -u targetuser --hudson

2. High-Speed Reporting & Proxy Rotation

# High-concurrency execution generating a styled PDF report with profile avatars
user-scanner -u targetuser -C 100 -f pdf -o target_analysis.pdf

# Route requests through a validated proxy list
user-scanner -u targetuser -P proxies.txt --validate-proxies

3. Programmatic Usage (Python Library Mode)

import asyncio
from user_scanner.core import engine
from user_scanner.email_scan.shopping import etsy

async def main():
    # Execute scan directly within your custom Python pipeline
    result = await engine.check(etsy, "target@gmail.com")
    print(result.to_json())

asyncio.run(main())

Summary

If you want to cut down manual reconnaissance time without juggling separate scripts for emails and usernames, user-scanner is a powerful addition to any OSINT toolkit. The combination of TLS impersonation, cross-pivoting, and infostealer breach checks makes it a huge step forward for digital footprinting in 2026.