WhatsMyName is a community-maintained JSON dataset that tells OSINT tools how to check whether a username exists on hundreds of public websites, for use in authorized investigations and digital-footprint review.
| Tool | WebBreacher/WhatsMyName — community-maintained dataset describing how to detect usernames across hundreds of websites |
| Category | OSINT reconnaissance dataset (JSON) with an ecosystem of checker tools |
| Primary Use | Pivot from a single username to confirmed accounts on 700+ sites during authorized identity verification, investigations, and self-audits of one's own footprint |
| Safe Use | For authorized OSINT analysts, investigators, and defenders auditing accounts they own or are legally permitted to investigate; not for stalking or unauthorized targeting of private individuals |
| Telemetry Note | The dataset itself is passive, but checker tools issue HTTP requests to each target site; defenders can detect enumeration via unusual per-user request patterns from client checkers like Naminter or Blackbird |
WhatsMyName occupies an unusual and instructive niche in the OSINT tooling landscape: it is not a scanner, a framework, or a script, but a dataset. The project, created in 2015 by Micah WebBreacher Hoffman and sitting at roughly 2,960 stars on GitHub, is essentially a single meticulously maintained wmn-data.json file in which each entry describes how to check one website for a username. That entry encodes what URL to query, what a successful response looks like, and what a "not found" response looks like. The insight behind this architecture is that detection logic and execution logic rot at different speeds, and separating them keeps the data useful no matter which client tool you prefer.
The origin story, as told in the README, is a familiar one in recon tooling: existing username checkers were full of false positives, so the author built a dataset that pinned down exactly what a positive hit means per site. Over years of community contribution, it grew into one of the most widely used username enumeration datasets in the OSINT community. That maintenance model matters more than any single feature — websites change profile URL structures, HTTP response codes, and page content constantly, so a static dataset would decay within months. The project survives because contributors continuously submit new sites and fix broken detections, with pathways for non-developers (a submission form), GitHub users (issues with example profiles), and JSON-literate contributors (pull requests guided by CONTRIBUTING.md).
Inclusion criteria are stricter than you might expect, and they reveal the mechanics of the checks. A site must be publicly accessible — no paywalls or login walls — the username must appear directly in the profile URL, and the site must not transform the username into a numeric ID or other opaque identifier. This means every detection in wmn-data.json is fundamentally a deterministic GET against a predictable URL path plus a response-signature comparison. It is a deliberately conservative design: sites with idiosyncratic resolution behavior are excluded rather than handled with fragile heuristics that would generate the false positives the project was created to eliminate.
A significant architectural pivot happened in May 2023, when the maintainers removed the bundled checker scripts and shifted focus entirely to the data file. That decision turned WhatsMyName into pure infrastructure, and the README now catalogs an unusually large ecosystem of consumers. The web front end at whatsmyname.app, built by Chris Poulter, offers category filtering and CSV export with live data pulls. An independent project at whatsmynameapps.us merges WMN data with the Sherlock and Maigret datasets, and a Chrome/Brave extension called Who Am I does the same in-browser. There is even a K2OSINT bookmarklet that takes a username in a popup and opens results in new tabs.
On the command line, the ecosystem is dominated by Python clients. Naminter was built specifically for this dataset and adds Cloudflare bypass, browser impersonation, and concurrent checking. Blackbird offers fast username search with WMN integration, while WhatsMyName-Python is a deliberately simple script and WhatsMyName-Client extends the model with custom request headers and POST support, which also makes it useful for testing the JSON configuration itself. Reveal My Name is the original checker that once shipped with the project, and WMN Screenshooter wraps Selenium around the results to capture evidence-grade screenshots of identified profiles.
The platform integrations are where the dataset shows its reach into professional workflows. SpiderFoot consumes WMN data in its sfp_account module, LinkScope uses it in an Online Identity category, and Maltego transforms from TURROKS check usernames in real time directly against the JSON file. The Rust-based sn0int framework exposes WMN via its kpcyrd/whatsmyname module. For analysts who need to keep queries inside their own infrastructure, there is a self-hosted Flask web app (WhatsMyName-Web) and a Docker API wrapper (wmn-docker), both community-maintained. NameSeeker rounds things out as an Electron desktop app with PDF, CSV, and JSON export.
Licensing deserves attention before you build anything on top of it. The data is released under CC BY-SA 4.0, meaning derivative datasets must be shared under the same terms and the project must be credited, with the README suggesting the phrasing "Uses data from the WhatsMyName project (CC BY-SA 4.0)." The name and logo, however, are explicitly not covered — describing your tool as "Powered by WhatsMyName data" is fine, while naming a product, domain, or app after the project requires permission, and calling anything "official" without written agreement is prohibited. The only official homes are the GitHub repository and whatsmyna.me, a useful note given how many third-party tools borrow the name.
From a defensive perspective, it is worth understanding what this dataset enables and what it does not. Every check it describes is a request against a public profile URL, indistinguishable from an ordinary page load in isolation; the signal for defenders is aggregate pattern, not individual requests. A single client sweeping hundreds of sites for one identifier produces a distinctive burst of requests to unrelated domains from one source, which is exactly the behavior WAF and behavioral analytics can flag if account-enumeration sweeps are a concern for your platform. Site operators should also note the inclusion criteria: if your profiles expose usernames directly in URLs without rate limiting, they are trivially enumerable by any tool consuming this data.
For the operator, the practical takeaway is that WhatsMyName is the substrate, and you pick the client that fits your workflow: whatsmyname.app for quick ad-hoc checks, Naminter or Blackbird for scripted recon, Maltego or SpiderFoot for graph-centric investigations, and the Docker wrapper for pipeline integration. The dataset's dynamic badge shows live site and category counts pulled directly from wmn-data.json, so any client that fetches the file fresh gets current coverage without tool updates — a clean decoupling that explains why this project has outlived many of the checkers built on it. Used within authorized investigations, identity verification engagements, and self-audits of your own footprint, it remains one of the most reliable foundations for username pivoting in the field.
WebBreacher/WhatsMyName.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.