Username Pivoting: How One Handle Links Profiles Across Platforms

A username is one of the most persistent digital footprints that exists. People create unique handles -- "shadow_recon", "l33tdev42", "moonwalker_br" -- and reuse them across dozens of platforms over years. What starts as convenience becomes a red thread connecting a 2016 Reddit profile to a 2018 GitHub to a 2021 Telegram to today's Fiverr.

Username pivoting is the technique of starting from a known handle and systematically tracking its presence across other platforms, correlating identities and building a complete profile of a person.

Why Usernames Are Persistent

Cognitive cost: creating a memorable username is mental work. Once someone finds something that works, they tend to reuse it for years.

Branding consistency: developers, content creators, and freelancers want to be found by the same handle. Reuse is intentional.

Forgetting traces: most people don't realize that every platform they sign up for is another correlation point. A 2014 forum registration remains indexed indefinitely.

Predictable variants: when the preferred handle is taken, fallback patterns are predictable -- shadow_recon turns into shadow_recon_, shadow_recon2, shadowrecon, sh4dow_recon.

Enumeration Tools

Sherlock

Sherlock is the most comprehensive tool for username searches across multiple platforms. It checks 400+ sites in parallel and returns confirmed URLs.

# Installation
git clone https://github.com/sherlock-project/sherlock
cd sherlock
pip3 install -r requirements.txt

# Basic search
python3 sherlock target_username

# Structured output
python3 sherlock target_username --output result.txt --csv result.csv

# Multiple usernames simultaneously
python3 sherlock username1 username2 username3 --output multiple.txt

# JSON output (for downstream processing)
python3 sherlock target_username --json result.json

# Increase timeout (slow networks or CDN-backed targets)
python3 sherlock target_username --timeout 30

# Filter by site category
python3 sherlock target_username --site Twitter --site GitHub --site Reddit

Sherlock checks platforms including: GitHub, GitLab, Reddit, Twitter/X, LinkedIn, Instagram, TikTok, YouTube, Twitch, Discord (invite links), Spotify, Steam, Patreon, Fiverr, HackerNews, Stack Overflow, Medium, Substack, Keybase, and hundreds more.

WhatsMyName

WhatsMyName has a different database from Sherlock, complementary rather than a substitute.

# Web version: whatsmyname.app
# CLI version:
git clone https://github.com/WebBreacher/WhatsMyName
cd WhatsMyName
pip3 install -r requirements.txt

python3 whats-my-name.py -u target_username

# Detailed output with categories
python3 whats-my-name.py -u target_username -o csv

Maigret

Maigret (inspired by Simenon's detective) goes beyond checking existence and extracts profile data when available.

pip3 install maigret

# Search and collect profile data
maigret target_username

# Output in multiple formats (HTML, PDF, JSON)
maigret target_username --html --folderoutput ./result/

# Verbose mode with data extraction
maigret target_username -v --pdf

# Search with proxies (anonymization)
maigret target_username --proxy socks5://127.0.0.1:9050

Maigret returns real name, bio, profile photo, declared external links, and account metadata, all from public sources.

Holehe

Holehe: checks if an email is registered across 120+ services (GitHub, Twitter, Instagram, Airbnb). Complementary to username pivoting: given a username that exposes an email, Holehe maps all linked platforms. Install: pip install holehe && holehe [e-mail]

Manual Pivoting Techniques

1. Variants and Typosquatting

When the exact username doesn't appear on a platform, test variants systematically:

def generate_variants(username):
    variants = [username]
    variants.append(username + '_')
    variants.append('_' + username)
    variants.append(username + '1')
    variants.append(username + '2')
    variants.append(username.replace('_', ''))
    variants.append(username.replace('_', '.'))
    variants.append(username.replace('_', '-'))
    # Common substitutions: a→4, e→3, i→1, o→0, s→5
    leet = username.replace('a','4').replace('e','3').replace('i','1').replace('o','0').replace('s','5')
    variants.append(leet)
    return list(set(variants))

for v in generate_variants('shadow_recon'):
    print(v)
# shadow_recon, shadow_recon_, _shadow_recon, shadow_recon1, 
# shadowrecon, shadow.recon, shadow-recon, 5h4dow_r3c0n, ...

2. Email Format Discovery

A username reveals email patterns, and email opens a wider search surface:

Username: john.smith42
Possible emails:
  [e-mail]
  [e-mail]  
  [e-mail]
  [e-mail]
  [e-mail]

Existence verification (without sending email):
  hunter.io/email-verifier
  emailhippo.com
  verify-email.org

Confirmed email leads to a breach check, which may expose compromised accounts with plaintext passwords, and from there to other platforms linked to the same email.

3. Profile Photo as Pivot

When a profile uses a real photo (not a generated avatar), the image may appear on other platforms:

# Reverse image search:
# Google Lens: images.google.com (drag the image)
# Yandex Images: yandex.com/images (more effective for faces -- uses neural networks for facial recognition, unlike Google which does perceptual pixel similarity -- the distinction matters for profile photos with angle or filter changes)
# TinEye: tineye.com (tracks exact copies)
# PimEyes: pimeyes.com (facial search -- ethical use required)

# Collect profile photo via direct URL
curl -s https://avatars.githubusercontent.com/target_username -o avatar.jpg

# Via Twitter/X API (public)
# https://twitter.com/target_username/photo
# x.com/target_username requires login for full profile; the absence of an unauthenticated alternative is a real limitation of the profile photo pivot on X/Twitter

# Extract EXIF from photo (device, location, date)
exiftool avatar.jpg

4. Bio and Links Correlation

People reuse entire bios or fragments of them. A unique bio excerpt indexed by Google connects accounts across platforms:

# Extract bio from a profile and search the text
# GitHub: curl https://api.github.com/users/target_username
# Reddit: curl https://www.reddit.com/user/target_username/about.json

# Search the bio text on Google (quotes = exact match)
# "security specialist and musician in my spare time" site:twitter.com OR site:instagram.com

# Or via dork
"exact bio copied" -site:github.com -site:reddit.com
# Removes known platforms, searches for new ones

5. Keybase and Verified Identity Platforms

Keybase allows users to cryptographically prove they control multiple accounts. A Keybase identity is a hub of voluntary correlation:

# Check Keybase profile
curl https://keybase.io/target_username/lookup.json | python3 -m json.tool

# Returns: verified accounts on GitHub, Twitter, Reddit, HN, personal sites
# Each listed account = confirmation without heuristics

(note: Keybase was acquired by Zoom in May 2020 and the security community largely migrated away -- useful for historical identity correlation on older accounts, but verify the last login date before trusting the data)

With fragments collected across multiple platforms, the next step is structuring what was found into a unified profile.

Data Correlation -- Building the Profile

After scanning across multiple platforms, structure what was found:

Illustrative example -- the data below is fictitious to demonstrate the method.

Username: shadow_recon

Confirmed platforms:
  GitHub:     github.com/shadow_recon (2018-present, 47 repos, Python/Go)
  Reddit:     reddit.com/u/shadow_recon (2016-2020, karma 4.2k, subreddits: netsec, hacking, brasil)
  HackerNews: news.ycombinator.com/user?id=shadow_recon (2019, 89 comments)
  Twitter/X:  x.com/shadow_recon_ (variant with _, 2021-present, 1.2k followers)
  Fiverr:     fiverr.com/shadow_recon (freelance pentest, reviews in PT-BR and EN)

Correlations:
  GitHub bio: "Security researcher | PT-BR | Open to remote"
  GitHub repos: OSINT tools, recon scripts
  Reddit: posts in PT and EN, mentions of Brazil
  Fiverr: declared location "Brazil"

Derived data:
  Languages: PT-BR (native), EN (fluent)
  Technical skills: Python, Go, pentest, OSINT (evidenced by repos)
  Active period: 2016-present (8+ years of digital presence)
  Possible contact: GitHub issues, Twitter DM, Fiverr

Possible real name: GitHub repository "shadow-recon/shadow-recon" has README 
  signed "João R." (2019) -- public data in the repo history

For a documented real case, Bellingcat and The Insider identified GRU officer Anatoliy Chepiga via username pivoting: cross-referencing profile photos, VKontakte and Instagram usernames, and Russian professional directories to link his travel pseudonym to his real military identity. Full report: Bellingcat/The Insider, 'Sergei Skripal's Poisoners Identified by Bellingcat and The Insider' (September 26, 2018), available at https://www.bellingcat.com/news/uk-and-europe/2018/09/26/skripal-poisoning-suspect-2-colonel-anatoliy-chepiga/.

Limitations and Ethical Considerations

Technical limitations:

• Rate limiting on popular platforms -- scans that run too fast lead to IP bans
• Closed platforms (private, deleted) are not accessible
• Deleted accounts indexed by Google may return stale results (IntelX.io indexes historical data including deleted accounts -- useful for investigating past presence)
• False positives: a popular username may belong to different people on different platforms

Usage considerations:

Username pivoting is legal when applied to:

• Cybercrime investigations (phishing, fraud, extortion) with legal backing
• Security due diligence (checking whether a vendor's username appears in breach data)
• Defensive OSINT (mapping your own digital footprint)
• Journalistic investigations in the public interest
• Bug bounty (identifying researchers)

It is not appropriate for:

• Tracking ex-partners, strangers, or people in personal contexts
• Collecting data for marketing or harassment
• Any use that violates LGPD Art. 7 (processing without a legal basis)

The technique is neutral. Use determines legality and ethics.

Automating the Pipeline

For repetitive investigations:

#!/bin/bash
# username-pivot.sh -- basic enumeration pipeline

USERNAME=$1
OUTPUT_DIR="./pivot_$USERNAME"
mkdir -p "$OUTPUT_DIR"

echo "[*] Sherlock..."
python3 sherlock/sherlock.py "$USERNAME" --csv "$OUTPUT_DIR/sherlock.csv" 2>/dev/null

echo "[*] WhatsMyName..."
python3 WhatsMyName/whats-my-name.py -u "$USERNAME" -o csv > "$OUTPUT_DIR/wmn.csv" 2>/dev/null

echo "[*] Maigret..."
maigret "$USERNAME" --json "$OUTPUT_DIR/maigret.json" 2>/dev/null

echo "[*] GitHub API..."
curl -s "https://api.github.com/users/$USERNAME" > "$OUTPUT_DIR/github.json"

echo "[*] Reddit..."
curl -s "https://www.reddit.com/user/$USERNAME/about.json" > "$OUTPUT_DIR/reddit.json"

echo "[*] Keybase..."
curl -s "https://keybase.io/$USERNAME/lookup.json" > "$OUTPUT_DIR/keybase.json"

echo "[+] Done. Results in $OUTPUT_DIR/"
echo "[+] Platforms found:"
grep -c "True\|found\|exists" "$OUTPUT_DIR"/*.csv 2>/dev/null

A single handle, pulled with patience and method, reveals far more than the person intended to share publicly. The protection is simple: unique usernames per platform, no reuse.