Sherlock Username Search — OSINT on 480+ Sites

What is Sherlock Username Search — OSINT on 480+ Sites?

This Apify Actor accepts one or more usernames (plain handles, @handles, profile links or email addresses) and scans Sherlock's current 481-entry catalog to find where each handle is registered. The default scan checks 462 non-NSFW entries; enabling includeNSFW adds the 19 adult-oriented entries. By default each input username produces one dataset item, so one record means one scanned handle and its per-platform results; set outputMode to per-hit to get one flat row per matched site instead, which suits CSV and spreadsheet work. The record includes timestamps, checked and targeted counts, confirmed CLAIMED profiles, uncertain WAF/timeout results, and a per-platform list with status, public URL, and detection method. It is usable through Apify and Apify MCP, with one predictable username-scan event per accepted username.

Best fit and connected workflows

This Actor fits workflows that start with a username and need a public footprint map across social, dev, gaming, forum, media, business, and related sites.

Good routing patterns include:

• public identity research from a known handle
• brand monitoring for username reuse across multiple site groups
• availability checks before reserving a handle on several platforms
• fraud, trust, and safety triage where a cross-platform account map helps review
• downstream enrichment that begins with confirmed public profile URLs and continues into profile detail scrapers, contact extraction, or manual review

The output is especially useful when a workflow needs to confirm public profile URLs first, then pass those URLs into downstream review, enrichment, or monitoring steps.

When to use this Actor

Use this Actor when you have one or more public usernames and need a structured cross-site account map before a human review or a downstream profile-enrichment step. If you start from a profile link or an email address, paste it as-is: the Actor reads the handle from the link, or uses the part before the @ of the email, and scans that. Choose a different workflow when you need to look up the owner of an email address itself, when the target data requires authentication, or when you need to prove account ownership. The Actor is scoped to public profile checks; private-account access, credential discovery, and access-control bypass are outside this workflow.

Practical scenario

Nina is reviewing a creator handle that appears on GitHub, Reddit, and a video platform. She enters the username as a plain handle and keeps includeAvailable off because she only needs registered profiles. The Actor returns platformsFound, platformsChecked, and a platforms[] list with site names, categories, URLs, and detection methods. Nina uses the claimed profile URLs to decide which accounts to inspect next and which ones to send into a separate enrichment workflow.

Input fields

Field	Type	Default	Description
usernames	string[]	Required	Usernames to scan. Paste plain usernames, @handles, profile links (for example instagram.com/name, x.com/name, github.com/name, tiktok.com/@name, youtube.com/@name, linkedin.com/in/name, or a profile link on any site in the catalog) or email addresses. A link becomes the handle in the link; an email address is scanned by the part before the @. Duplicates are removed after this step. Values with no readable username, such as links to a post or video, are skipped and listed with the reason in the run status and OUTPUT.rejectedInputs. Each username triggers one scan and one billable event. Max 100 values per run.
includeAvailable	boolean	false	Includes platforms where the username is available, alongside claimed profiles. Useful when checking availability before registering on multiple platforms.
includeNSFW	boolean	false	Includes adult-oriented sites in the scan when enabled. Useful for compliance, brand-protection, or fraud-investigation workflows where adult-site presence matters.
categories	string[]	[]	Limits the scan to selected site groups such as social, dev, gaming, forum, media, business, or other. Empty array scans the full 462-entry non-NSFW set, or all 481 entries with includeNSFW.
sites	string[]	[]	Optional. Check only these sites, by catalog name (GitHub, Reddit, Instagram, Steam...) or domain (github.com). Works together with categories. Unknown names are listed in the run warnings; if none match, the run ends as invalid input with no charge. Price stays one event per username.
concurrency	integer	60	Number of site checks running at once, in one shared pool across all usernames. Higher is faster and uses more memory.
requestTimeoutSecs	integer	15	Maximum seconds to wait for one site response before the site is marked as timed out.
outputMode	string	per-username	per-username returns one row per username with a nested platforms[] list. per-hit returns one flat row per matched site (username, site, category, URL, status, detection method). Billing is the same in both modes: one username-scanned event per username.
maxHitsPerUsername	integer	0	Optional cap. Stops scanning a username once this many sites report an account (0 = scan every site). Price stays one event per username.
verifyHits	boolean	true	Re-checks every hit with a random made-up username. A site that also "finds" the made-up name cannot prove anything, so that hit moves to the uncertain list. Confirmed hits carry verified: true.
includeProfileDetails	boolean	false	Adds the public page title, description and image (profile) to confirmed hits. No extra fee.
proxyConfiguration	object	No proxy	Requests go directly to each site by default. If you choose an Apify proxy, it is used only to re-check sites that blocked the direct request, so proxy traffic stays small.

Focused JSON example

{
  "usernames": ["khadinakbar", "gvanrossum"],
  "includeAvailable": false,
  "includeNSFW": false,
  "categories": ["dev"],
  "concurrency": 60,
  "requestTimeoutSecs": 15,
  "verifyHits": true,
  "includeProfileDetails": true
}

Flat per-hit example

{
  "usernames": ["gvanrossum"],
  "categories": ["dev"],
  "outputMode": "per-hit"
}

Each per-hit row looks like this:

{
  "recordType": "hit",
  "username": "gvanrossum",
  "site": "GitHub",
  "category": "dev",
  "url": "https://github.com/gvanrossum",
  "status": "CLAIMED",
  "detectionMethod": "status_code",
  "httpStatus": 200,
  "isNSFW": false,
  "platformsChecked": 60,
  "platformsFound": 9,
  "scanIncomplete": false,
  "scanStartedAt": "2026-10-16T10:00:00.000Z"
}

While a scan runs, the run status shows live progress, for example Scanning "gvanrossum" (1/2): found on 9 site(s) so far, 160/462 checked.

A username that matches no site produces no per-hit row; it is still listed in RUN_SUMMARY and charged as one scanned username.

Output fields

Field	Type	Description
username	string	The username that was scanned.
usernameSource	string	How the username was obtained: handle (plain or @handle), url (read from a profile link) or email (the part before the @ of an email address).
originalInput	string	The input value exactly as you supplied it.
scanStartedAt	string	ISO 8601 timestamp for when the scan started.
platformsChecked	integer	Number of platforms actually checked for this username.
platformsTargeted	integer	Number of platforms selected by the input filters before timeout-aware early stopping.
platformsFound	integer	Number of platforms where the username is registered.
platformsVerified	integer	Hits that passed the random control-name check.
falsePositivesRemoved	integer	Hits moved to the uncertain list because the site also reported an account for a random control name.
scanRoute	string	direct, or direct+proxy-for-blocked when you supplied a proxy and blocked sites were re-checked through it.
foundOn	string[]	Names of the sites where the username is registered, for a quick read without opening platforms[].
platformsBlocked	integer	Number of platforms whose response was protected by anti-bot controls or remained uncertain because of a transient response.
scanDurationMs	integer	Total scan duration in milliseconds.
scanIncomplete	boolean	Indicates that the scan returned partial results.
stopReason	string	Reason the scan stopped early when partial results were returned.
platforms	array	Per-platform results with site, category, URL, status, detection method, HTTP status, NSFW flag, a verified flag on confirmed hits, optional profile (title, description, image) and an uncertainty reason when applicable.
blocked	array	Sites where the response was protected by anti-bot controls or remained uncertain; these rows represent review candidates rather than confirmed accounts.
_note	string	Human-readable scan summary.

Illustrative JSON record

{
  "username": "gvanrossum",
  "scanStartedAt": "ISO_8601_SCAN_TIMESTAMP",
  "platformsChecked": 481,
  "platformsTargeted": 481,
  "platformsFound": 23,
  "foundOn": ["GitHub", "HackerNews", "Reddit", "..."],
  "platformsBlocked": 4,
  "scanDurationMs": 27310,
  "scanIncomplete": false,
  "stopReason": "",
  "platforms": [
    {
      "site": "GitHub",
      "category": "dev",
      "url": "https://www.github.com/gvanrossum",
      "status": "CLAIMED",
      "detectionMethod": "status_code",
      "httpStatus": 200,
      "isNSFW": false
    },
    {
      "site": "Hugging Face",
      "category": "dev",
      "url": "https://huggingface.co/gvanrossum",
      "status": "CLAIMED",
      "detectionMethod": "status_code",
      "httpStatus": 200,
      "isNSFW": false
    }
  ],
  "blocked": [
    {
      "site": "Instagram",
      "url": "https://instagram.com/gvanrossum",
      "reason": "WAF-Cloudflare"
    }
  ],
  "_note": "23 platforms found. 481 checked. 4 protected or timed-out responses."
}

How it works

This Actor uses Sherlock's site catalogue and three-mode detection model:

• status_code for sites where the HTTP status distinguishes existing and missing profiles
• message for sites that return a page body with a profile-existence message
• response_url for sites that redirect missing handles and can be checked by the final URL

Requests go straight to each site, with no proxy needed. All site checks for all usernames share one sliding request pool, so a few slow sites never hold up the rest of the scan. Every hit is then re-checked with a random made-up username: if a site reports an account for that made-up name too, the hit cannot be trusted and moves to the uncertain list, which keeps confirmed results clean. If you supply an Apify proxy, it is used only to re-check sites that blocked the direct request. A username that runs past its 150-second time budget ends as a partial result that says how many sites were not checked.

The scan supports category filters, optional NSFW coverage, and per-request timeouts. Anti-bot challenges, rate limits, server-side responses, and network failures remain WAF or UNKNOWN instead of being reported as confirmed accounts. The execution contract also writes OUTPUT, RUN_SUMMARY, and SUMMARY records for machine-readable outcome and terminal details.

Pricing

This Actor uses Pay per event plus Apify platform usage. The primary event is username-scanned, charged once for each accepted username processed across the selected site set. The price is flat per username: it is the same whether no site or every site matches, and the same in per-username and per-hit output modes. Each run also has a small apify-actor-start event. See the Pricing tab for current prices. Direct requests need no proxy, so Apify platform usage per username is small.

Worked example: scanning two usernames charges two username-scanned events. In the default mode it returns two rows (one per username); in per-hit mode it returns one row per matched site.

Use with AI agents (MCP)

This Actor is available as an Apify Actor usable through Apify MCP. It accepts usernames, scans the configured site catalogue, and returns structured dataset items that agents can route into follow-up analysis.

Tool description: scan one or more usernames across Sherlock's 481-site catalog and return confirmed profile URLs, per-platform status, detection methods, WAF/unknown details, and run summary fields at a predictable per-username charge.

Exact Actor identity: khadinakbar/username-osint-scraper

Scan the username khadinakbar and return claimed public profiles, protected or timed-out responses, and a short summary. Then extract the GitHub and Reddit URLs for manual review.

How to interpret the output:

• CLAIMED means the username is registered on that platform
• AVAILABLE appears when includeAvailable is enabled
• WAF marks a response protected by anti-bot controls
• UNKNOWN marks a network issue, timeout, rate limit, server-side response, or access challenge
• platformsFound, platformsBlocked, and scanIncomplete help agents judge how much of the catalogue was completed

Provenance and scope:

• each dataset item represents one scanned username
• platforms[] contains the per-platform evidence behind the summary fields
• blocked[] captures sites where a reliable status remains to be established
• results are based on public profile URLs and platform responses only

Pagination and cost guidance:

• scan one username per agent step when you want simple charge accounting
• use categories to narrow the site set when the workflow only needs a subset such as dev or social
• each username in the input array is one billable event

Apify API example

import { ApifyClient } from "apify-client";

const client = new ApifyClient({
  token: process.env.APIFY_TOKEN,
});

const run = await client.actor("khadinakbar/username-osint-scraper").call({
  usernames: ["khadinakbar", "gvanrossum"],
  categories: ["dev"],
  includeAvailable: false,
  includeNSFW: false,
  concurrency: 40,
  requestTimeoutSecs: 15,
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Best results and outcome guidance

Paste usernames the way you have them: plain handles, @handles, profile links or email addresses all work. Links to a post, video or search page have no username in them and are skipped with a reason in OUTPUT.rejectedInputs. Start with one handle per run when you want straightforward charge accounting and easy review, then expand to batches when your workflow is ready for multiple identities. Use categories to focus the scan on the site groups that match your task, and enable includeAvailable when availability coverage is part of the goal. For public-profile review, treat only CLAIMED URLs as confirmed handoff points; review WAF and UNKNOWN rows separately.

Focused standalone workflow

This Actor is designed as a focused standalone workflow.

Builder's note

I designed the default output as one record per username so an agent can read every result for a handle at once, and I added the per-hit mode for people who export to spreadsheets and want one site per row. Uncertain WAF and timeout responses stay separate from CLAIMED hits in both modes.

FAQ

Can I scan more than one username in a single run?

Yes. The usernames field accepts an array of up to 100 handles, profile links or email addresses, and each username is processed as its own scan item.

What kind of result should I expect for a standard OSINT workflow?

The default output centers on CLAIMED results, plus protected or uncertain responses in blocked[] and platformsBlocked. If you enable includeAvailable, the Actor also returns AVAILABLE entries for availability checks, while WAF and UNKNOWN remain explicitly uncertain.

How should I route a handle into another workflow?

Use the URLs in platforms[] to hand off confirmed public profiles to downstream enrichment Actors, review steps, or monitoring tools. The categories help you isolate relevant platforms before that handoff.

How do I work with protected or timeout-heavy sites?

Review blocked[] and platformsBlocked together. These fields show which platforms returned protected or incomplete responses, which helps an agent decide whether to retry with different filters or move forward with the confirmed hits.

Why are some sites in the uncertain list even though they answered?

Each hit is re-checked with a random made-up username. Sites that also report an account for the made-up name (some answer "found" for everything) cannot confirm a real account, so they appear under blocked[] with a clear reason instead of in your confirmed list.

How fast is it, and how much memory does it use?

A single username across all 462 sites takes about 40 seconds. Memory is chosen automatically from the number of usernames you paste (512 MB for 1 to 7, 1 GB for 8 to 15, 2 GB for 16 to 31, 4 GB for 32 or more), so large batches finish in minutes instead of hours. You can still set memory yourself in the run options. Platform usage per username stays at a small fraction of a cent for direct requests.

Do I need a proxy?

No. Requests go directly to the sites. If you add an Apify proxy, it is only used to re-check sites that blocked the direct request.

Why use categories at all?

Categories let you focus on a subset such as dev or social when a workflow only needs a specific platform group. Leaving categories empty scans the full catalogue.

Related Actors

• Instagram Profile Email & Phone Scraper: Full Instagram profile details for a found account.
• TikTok Profile Scraper — Followers, Bio & Score: Full TikTok profile details for a found account.
• YouTube Channel Email Scraper — Emails, Phones & Socials: Public contact details from YouTube channels.
• Reddit User Profile Scraper: Karma, account age and post history for a found Reddit account.
• GitHub Deep Scraper: Repos, contributions and profile data for a found GitHub account.
• LinkedIn Profile Details Scraper: Public profile details when the handle matches a LinkedIn profile.

Scope and legal boundary

Use this Actor for legitimate public-profile research, brand protection, fraud detection, recruiting, journalism, and similar workflows. The Actor checks public profile URLs and records platform responses for the usernames you provide. Respect applicable privacy laws, platform terms, and your own organizational policies when using the returned data. This independent Actor uses the open-source Sherlock site catalog (MIT licence) and is not affiliated with, associated with, or endorsed by the Sherlock Project.