A hunt that stops at https://twitter.com/{handle} is a template. It is not evidence. The page may 404. The same handle may belong to three people. A desk that stores that URL as a node is lying to the operator.
MAGO ships username hunts as an identity graph on mago.team. Nodes are attested pages. Edges are same-person relations pulled from JSON the platforms already publish.
Templates are not identity
HEAD requests against a guessed profile URL tell you the host answered. They do not tell you the person exists. GitHub, GitLab, Reddit, Hacker News, and Keybase each expose a JSON document for a named account. That document is the record. The HTML chrome is decoration.
GitHub's user payload includes blog, twitter_username, and social_accounts. Those fields are the operator's next hops. They are not guessed. They are claimed by the account owner on GitHub's API.
GitLab users, Reddit about.json, HN Algolia hits, and Keybase proofs follow the same rule. Fetch the document. Parse fields. Keep the URL only if the document names the handle.
The documents you actually fetch
GitHub: GET https://api.github.com/users/{handle}. Read login, blog, twitter_username, html_url. Then GET /users/{handle}/social_accounts for {provider, url} pairs. Dev.to also publishes GET https://dev.to/api/users/by_username?url={handle}.
GitLab: GET https://gitlab.com/api/v4/users?username={handle}. The first object is the person if the list is not empty. Website and bio sit on that object.
Reddit: GET https://www.reddit.com/user/{handle}/about.json. The live handle is data.name. Subreddit title and public description are extra labels, not extra people.
Hacker News: GET https://hn.algolia.com/api/v1/users/{handle}. A 404 is a missing user. A hit is a named account with karma and about text.
Keybase: GET https://keybase.io/_/api/1.0/user/lookup.json?usernames={handle}. Proofs in that payload name GitHub, X, Reddit, and a website. Those proofs are the edges.
None of these calls need a browser. None of them need a 200 from twitter.com/{handle}.
A HEAD probe misses four things. First, a parked profile that still 200s. Second, a renamed handle whose old URL 301s to someone else. Third, a display name that is not the login. Fourth, social links that live only in JSON. The graph records the document. It does not record the folklore.
Same person is a relation, not a vibe
Two nodes share a person when a document on one platform names the other. GitHub twitter_username pointing at X. A Keybase proof pointing at GitHub. A blog URL that matches a GitLab website field.
Confidence is not a slider. It is whether the source page was fetched and parsed. MAGO stores that as an attested page record on the investigation. The graph is the present step of collect, extract, correlate, present.
A list of green ticks is a scanner. An investigation is a workspace that keeps those relations next to the hunt that produced them.
Sherlock-style checkers enumerate sites. MAGO correlates claimed accounts. Enumeration is a list. Correlation is a graph. Operators already have lists. They need the second thing on a desk that already holds the hunt. The hunt that produced the GitHub node is the same hunt that billed milliscale credits. The graph does not fork that billed order.
What the desk actually does
Open an investigation on mago.team. Name it. Hunt a username from that case. The scan still quotes, queues, and writes a report. The identity graph is extra surface on the same order: nodes for GitHub, GitLab, Reddit, HN, Keybase when the JSON exists.
Edges carry labels such as same-handle or claimed-account. The canvas lives in the investigation workspace. It is not a marketing force graph on the home page.
The hunt bar stays hunt. Creating a case is a title and Open. Mixing those verbs is how desks turn into SaaS forms.
Credits still debit by module. Email hunts and domain hunts keep their own spell costs. Username identity is one more surface on the same milliscale wallet. You do not buy a second product to keep the person.
Why this belongs on mago.team
Operators buy a hunt, then they need a place to keep the person they found. A report is a snapshot. An investigation is the file that survives the next pivot.
Run the next username from https://mago.team. Open an investigation first. Let the graph fill from attested pages, not from URL folklore.
Top comments (0)