maigret for username-based OSINT account discovery

maigret is a Python OSINT tool that checks a username against 3,000+ sites and compiles a dossier of linked accounts for authorized investigations and defensive research.

Tool	soxoj/maigret — username-enumeration OSINT framework that checks 3,000+ sites and extracts profile information without API keys
Category	OSINT / reconnaissance / social media intelligence (SO CMINT)
Primary Use	Mapping a subject's account footprint across platforms by checking a single username against a ranked site database, then recursively expanding on discovered IDs
Safe Use	Authorized investigations, pentest recon within scope, law-enforcement and corporate OSINT work, and defensive research into an organization's exposed account sprawl
Telemetry Note	Generates high volumes of profile-page requests from one source; site operators see coordinated lookups in logs, and rate-limit/CAPTCHA systems will trigger — investigators must comply with platform terms and local law

maigret, hosted at soxoj/maigret and written in Python, has become one of the reference tools in the OSINT tooling space, evidenced by nearly 37,500 stars on GitHub and an MIT license. Its core premise is simple but powerful: given only a username, it queries a database of more than 3,000 sites and reports which of them host an account under that name, then extracts whatever identifying information the profile pages and site APIs expose. Unlike many reconnaissance tools, it requires no API keys, which dramatically lowers the barrier to entry for analysts working in environments where registering for developer accounts is impractical or leaves an audit trail of its own.

The name is a deliberate nod to Georges Simenon's detective, and the framing matters: maigret is not a scanner or an exploit tool but an investigator's assistant that assembles a dossier. A default run checks the 500 highest-ranked sites by traffic, which is a sensible operational default — it balances coverage against time and network footprint. The -a flag expands the run to the full database, while --tags narrows the target set by site category or country, so an analyst investigating a subject whose activity is concentrated in, say, photographic or dating communities can use --tags photo,dating and avoid noisy queries against irrelevant platforms.

What distinguishes maigret from earlier username-checkers like sherlock — which it explicitly lists among its topics — is extraction and recursion. The README notes that it leverages the author's companion project socid_extractor to pull structured data from profile pages and site endpoints, including links to other accounts. That last detail enables recursive search: when maigret discovers an alternate username or identifier in a profile, it can pivot and continue the search under that new handle. For an authorized investigator, this recursive expansion is the tool's most valuable capability, because actors rarely maintain consistent handles across platforms and cross-linking is where attribution evidence typically lives.

The architecture, as the README describes it, is a site-database-driven engine with a self-updating data layer. maigret fetches an auto-updated site database from GitHub once per 24 hours and falls back to a built-in database when offline. This is a pragmatic design choice: site templates and detection heuristics rot quickly as platforms redesign their profile pages, so decoupling the engine from a refreshable database keeps detection accuracy high without requiring code releases. The database itself is browsable in the repository as sites.md, which is useful for defenders who want to understand exactly which platforms a run will touch.

From a defensive and operational-awareness standpoint, maigret also acknowledges the adversarial relationship with target platforms. The README states that it detects and partially bypasses blocks, censorship, and CAPTCHA, and it works over Tor and I2P, including checking .onion-style hidden services and arbitrary domains. It also supports proxy usage, as the sponsor section suggests. For blue teams, this means the tool's traffic is not invisible: a run produces hundreds of rapid profile lookups from a single source IP, which shows up clearly in rate-limit logs and anomaly detection. For investigators, it raises a governance question — bypassing platform controls must stay within the legal and contractual boundaries of the engagement.

Reporting is where maigret shows its professional orientation. Output formats include --html, --pdf (an optional extra installed via pip install 'maigret[pdf]'), --xmind for mind-mapping imports, --csv, --txt, and machine-readable --json ndjson exports. More interesting for teams running graph-based investigation workflows, --graph produces an interactive D3 visualization and --neo4j emits a Cypher script (*_neo4j.cypher) that imports idempotently into a Neo4j graph database via cypher-shell. The --keywords flag highlights sites whose pages also mention given terms — useful for confirming account ownership through contextual evidence such as a stated technology or location rather than handle collision alone.

Installation options are unusually broad for a tool in this category. Beyond pip install maigret, the README documents a standalone Windows executable (maigret_standalone.exe) from GitHub Releases, a strictly-confined snap package for Linux on amd64 and arm64, Docker images in two flavors (soxoj/maigret:latest for CLI and soxoj/maigret:web for the web interface), and zero-install paths via Cloud Shell, Colab, Binder, and a community Telegram bot. The web interface renders results as a graph and allows downloading reports in every format from a single page, which makes the tool accessible to analysts who are not comfortable at a terminal. Python 3.10+ is the stated minimum.

Two more capabilities deserve attention. First, maigret is embeddable as a library — import maigret in a Python project allows programmatic searches, and the README's 'Used by' section shows this is not theoretical: commercial OSINT products including SocialLinks offerings and UserSearch build on it. Second, there is an optional --ai mode that sends raw findings to an OpenAI-compatible API (requiring OPENAI_API_KEY) to generate a short investigation summary. That convenience carries a disclosure consideration: piping subject data into a third-party model service is a data-handling decision that should be documented in an engagement's privacy assessment before it is used.

In an authorized workflow, the canonical use case is early-phase subject research: an investigator with lawfully obtained consent or mandate, a pentester mapping a client's employee account sprawl to quantify phishing exposure, or a threat-intel analyst correlating a suspicious handle across platforms. In the phishing-exposure scenario the value is defensive — discovering that 40 of a client's staff have discoverable accounts on platforms outside corporate visibility is a concrete finding for security-awareness programs. What maigret does not do is exploit anything; it reads what platforms publicly render, which is precisely why it sits on the lawful side of the reconnaissance toolkit when used with authority.

The obvious caveats are the flip side of its power. Username collision means a hit is a lead, not proof of identity, and competent analysts will corroborate with extracted attributes, --keywords matches, and cross-links before drawing conclusions. Privacy law varies sharply by jurisdiction, and mass collection about a private individual can be unlawful even when the collection method is passive. Operators should treat maigret as an evidence-gathering instrument subject to the same authorization, minimization, and documentation discipline as any other investigative technique, and defenders should assume adversaries are using it — username hygiene across platforms is a measurable control, and maigret itself is the tool that measures it.

Official project repository for soxoj/maigret.

Download Tool

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.