Positioning: A Username Is A Thread, And Maigret Pulls Until The Sweater Unravels
Every now and then a project lands on our desk that forces us to write two articles at once: the technical review, and the moral disclaimer. soxoj/maigret is exactly that kind of project. On the surface it is a Python command-line tool with a tagline so casual it almost reads as innocent — “Collect a dossier on a person by username from 3000+ sites.” Underneath that tagline sits one of the most capable open-source OSINT instruments ever shipped under an MIT license, a tool that takes a single string of text — a handle, a nickname, an old gaming alias — and turns it into a structured dossier of accounts, profile pictures, registration dates, follower counts, locations, full names, and cross-linked identities scraped from thousands of public web properties.
We want to be very clear about how we are positioning Maigret in our coverage, because positioning is the entire fight here. Maigret is not a “search engine.” It is not a “social media aggregator.” It is not, despite some of the cheerful language in tutorials, a “fun way to look up your friends.” Maigret is a username-based OSINT dossier compiler, and a dossier is the technical term for an instrument of investigation. Investigators use dossiers. Journalists use dossiers. Pentesters and red teams use dossiers as the opening move of a social engineering campaign. Stalkers and abusers also use dossiers, and they have always used dossiers, and the only thing that has changed in the last decade is how cheap and how thorough the dossier has become. Maigret is the current state of the art for cheap and thorough.
The project sits in a lineage: Sherlock came first, a simple username-checker that fanned out across a few hundred sites and reported “found” or “not found.” Maigret is a fork of that idea taken to its logical extreme — site coverage roughly an order of magnitude larger, profile parsing instead of mere existence checks, recursive identity discovery, censorship and captcha detection, Tor and I2P support, and report generation in HTML, PDF, CSV, JSON, and XMind. If Sherlock is a flashlight, Maigret is a forensic lighting rig with attached transcription. We will spend the rest of this article explaining why that distinction matters technically, and why it matters even more ethically.
For our readers who follow GitHub Radar primarily for engineering insight, you will find plenty of that — the asynchronous execution model, the JSON-defined site database, the activation mechanism for sites behind cookie or JWT walls, the proxy-aware checker that supports rotating exit nodes. But we are going to keep returning to a single uncomfortable observation throughout the piece: the engineering quality of Maigret is precisely what makes it dangerous, and the dual-use problem here is not theoretical. It is the central feature of the artifact.
Why It Is Surging Right Now
Maigret has been on GitHub since June 2020, and its star graph has been climbing steadily for years, but the recent acceleration — over five hundred new stars in a single day, against a baseline of roughly twenty-one thousand — tells us the project is entering a new phase of attention. We see three distinct currents pushing it up the charts simultaneously, and they are pulling in directions that do not entirely agree with each other.
The first current is straightforward professional demand. The OSINT discipline, which until a few years ago was the province of a small community of investigators and intelligence analysts, has gone genuinely mainstream. Bellingcat-style open-source investigation is now taught in journalism schools. Trust and safety teams at large platforms run username-correlation workflows as a matter of course when investigating coordinated inauthentic behavior. Corporate threat intelligence groups use these tools to map the public footprints of phishing operators and cryptocurrency scammers. Law enforcement uses them under judicial process. The supply of trained OSINT practitioners has expanded dramatically, and the tooling those practitioners reach for has had to keep pace. Maigret, with its readable Python codebase, its no-API-keys promise, and its broad site coverage, is the tool that meets a new analyst exactly where they are.
The second current is the broader pentest and red team ecosystem treating username enumeration as a first-class reconnaissance step. Modern social engineering rarely starts with a phone number or an email; it starts with a handle scraped off a leaked database or a forum post, and the very first move is to confirm whether that handle is reused on other platforms. If a target uses the same nickname on a professional network, a hobbyist forum, a dating site, and a gaming platform, you have just learned things about that person that no LinkedIn-only profile would tell you. Maigret automates that first move at industrial scale.
The third current is the one we find most uncomfortable to write about, but ignoring it would be a journalistic failure. There is a meaningful, growing population of users who are downloading Maigret not for research, not for security work, and not for journalism, but because the line between OSINT and stalkerware is thinner than the OSINT community likes to admit. The same tool that lets a journalist trace a propaganda network lets an abusive ex-partner reconstruct the digital life of someone who is trying to disappear. The same tool that helps a fraud investigator identify a romance scammer lets a doxing campaign assemble a target package on a private citizen who said the wrong thing online. The licensing language and the README disclaimers do not slow that population down. We have seen Maigret recommended in places we would rather not name. The surge is partially a healthy professional surge, and partially something else, and pretending otherwise would be naive.
To this we add a smaller but real fourth driver: the rise of regulatory attention to stalkerware and commercial spyware in the United States and the European Union. As paid surveillance vendors come under sanction, free and open-source equivalents draw users who would previously have bought a commercial product. The economics of investigation have shifted, and Maigret happens to sit in the middle of that shift.
Deep Architecture: Site Database, Async Executor, Recursive Dossier
The core abstraction in Maigret is the site definition. The project ships a large JSON file (data.json) that contains thousands of entries, each describing how to interrogate a single web property to determine whether a given username exists there and, if so, what additional information can be extracted from the public profile page. Each entry binds together a URL template, a “check type” (HTTP status, response message, content keyword, or response URL), strings that signal presence or absence of an account, optional headers and cookies, and tags that classify the site by category and country. The MaigretDatabase class loads these definitions at startup and exposes them as a dictionary of MaigretSite objects to the rest of the system. This is, in a meaningful sense, the project’s actual asset — the code is replaceable, but the curated, maintained list of three thousand-plus site fingerprints represents thousands of hours of community labor and reverse engineering.
Around this database sits the MaigretCore, which orchestrates a search. Given a username, the core filters the site dictionary — by tag, by country, by the popularity rank that lets users restrict to “top 500” rather than the full three thousand — and hands a list of tasks to an asynchronous executor. The executor we want to highlight specifically is the AsyncioProgressbarQueueExecutor, a queue-based scheduler that runs a configurable pool of workers concurrently, each pulling site-check tasks off the queue. This is what allows Maigret to query thousands of sites in minutes rather than hours. It is also, incidentally, what makes the tool legible to Python engineers who have written async I/O before; there are no exotic abstractions, just a sensible producer-consumer pattern wrapped around aiohttp.
The actual per-site work happens in check_site_for_username, which dispatches to one of several checker classes depending on the site definition. The default checker uses aiohttp directly. The ProxiedAiohttpChecker routes traffic through a proxy, which is how Maigret supports Tor and I2P endpoints. The activation mechanism is more interesting than it looks: some sites refuse anonymous traffic and require a session cookie, a JWT, or a CSRF token to return meaningful responses. Maigret accommodates this by allowing a site definition to declare an “activation” function that runs once before checks begin, populating credentials that subsequent requests carry. This is the closest thing the project has to a true plugin system — site definitions are data, but activation logic is code, and the line between them is where extensibility lives.
Once a site responds, Maigret does not merely record “found” or “not found.” If the response is a profile page, the data extractor kicks in. The extractor parses HTML for known patterns — OpenGraph tags, structured data, site-specific selectors — and pulls out fields like the user’s stable numeric ID, avatar URL, registration timestamp, geographic location, follower and following counts, declared full name, biography text, and any external links present in the profile. Those external links are, in turn, scanned for usernames and identifiers, which feeds the recursive search: any handle found embedded in a profile becomes a new search seed, and the dossier expands outward from the original input. This is the move that lifts Maigret out of the “username checker” category. A pure checker tells you that jdoe exists on platforms A, B, and C. Maigret tells you that jdoe on platform A links to j.doe.real on platform D, which links to a profile on platform E that declares a full name and a city, and the city matches the timezone of the original account, and the avatar hashes match across three of those properties. That is not a checker. That is link analysis.
Rate-limit evasion is handled less aggressively than the marketing might suggest, and we appreciate that restraint. There is no built-in attempt to hammer sites until they respond. Instead, the project uses concurrency to spread requests across many destinations rather than concentrate them on one, retries transient failures with sensible backoff, detects censorship stubs and CloudFlare interstitials and surfaces them as warnings to the user, and supports proxy rotation when the user explicitly configures it. The Tor and I2P support is genuinely useful for investigators who need to query sites that geo-block their actual location, but the same support is also the obvious vector for abusers who want to disguise the source of their reconnaissance, and we do not have an answer for that tension.
The report generator deserves a paragraph of its own. Maigret produces output in HTML (with embedded interactive elements), PDF, CSV, JSON, and XMind — the last being a mind-mapping format used by a particular kind of investigator who likes to visually trace identity graphs. The HTML report includes graph visualization of cross-platform links, side-by-side comparison of profile photos, and a chronologically sorted timeline of registration dates across discovered accounts. From a UX perspective this is excellent work. From an ethical perspective the polish itself is part of what gives us pause: the difference between raw data and a polished dossier is enormous, and Maigret hands the polished version to anyone who can install a Python package.
One more architectural note. The web interface, served locally, mirrors the CLI but lowers the technical barrier substantially — users who could not reasonably be called developers can install a Python package, run a single command, and interact with a graphical interface. We mention this because every comparable tool we will discuss in section five assumes a more technical operator. Maigret does not, and that accessibility is part of its appeal and part of its risk.
Code And Community Health
By the standard metrics, Maigret is in robust shape. The repository sits at roughly 21,671 stars at the time of writing, with about 1,513 forks, a watcher count that mirrors the star count, and roughly 60 open issues against a long tail of closed ones. The license is MIT — permissive, unambiguous, and practically inviting redistribution and integration into other tools. The most recent push was within the last three days; the repository was updated within the last day. This is an actively maintained project, not an abandoned one.
The codebase is Python, primarily Python 3, structured around the modular components we described in the architecture section. Documentation lives at maigret.readthedocs.io and is, for an OSINT tool, unusually thorough — there are tutorials for site-definition contributions, references for the report formats, and discussion of the activation mechanism. The repository has GitHub Discussions enabled, which is a meaningful signal that the maintainer is willing to engage with the user community rather than route everything through the issue tracker.
Contribution patterns lean toward site database expansion rather than core engine changes. This makes sense: the engine is mature, and the value of any new contribution is largely a function of whether it adds coverage of platforms not previously supported. The fork count of fifteen hundred is high but somewhat misleading — OSINT tools attract a lot of “I want to add my country’s local sites” forks that never merge upstream, and we suspect a meaningful fraction of those forks are exactly that.
The maintainer, soxoj, is a recognizable figure in the Russian-language OSINT community and has produced auxiliary educational material around the tool. From a community-health perspective this is a strength — there is a clear leader with subject-matter expertise — and a structural risk: bus factor on a project this consequential should not be one. We have not seen evidence of a deep co-maintainer bench. If soxoj steps away, the site database will gradually drift out of sync with the moving target of platform changes, and the tool will degrade.
Topic tags on the repository tell their own story: blueteam, redteam, pentesting, osint, reconnaissance, socmint, investigation, cybersecurity, infosec, namechecker. The maintainer has consciously positioned the tool inside the security and intelligence professional corpus, not the general utility category. We respect that framing; we also note that GitHub topic tags do not control downstream use.
How It Compares: Maigret, Sherlock, WhatsMyName, Spiderfoot, And Maltego
Username and identity OSINT is a crowded space. To position Maigret precisely, we need to compare it on at least a dozen dimensions against four representative alternatives: Sherlock (the direct ancestor), WhatsMyName (the curated community list), Spiderfoot (the broader OSINT framework), and Maltego (the commercial graph platform that defined the category).
| Dimension | Maigret | Sherlock | WhatsMyName | Spiderfoot | Maltego |
|---|---|---|---|---|---|
| Primary input | Username | Username | Username | Many entity types | Many entity types |
| Site/source coverage | ~3,000+ | ~400 | ~600 curated | 200+ modules, varies | Hundreds of transforms |
| License model | MIT, free | MIT, free | Data CC, free | MIT (community), paid HX | Commercial, freemium |
| API keys required | None | None | None | Many modules require | Most transforms require |
| Profile data extraction | Yes, structured | No, presence only | No, presence only | Module-dependent | Yes, transform-dependent |
| Recursive identity expansion | Yes, automatic | No | No | Yes, via correlations | Yes, manual or scripted |
| Async / concurrency | asyncio + aiohttp | asyncio | N/A (data project) | Threaded | Server-side |
| Tor / I2P support | Native | None | N/A | Plugin-dependent | Limited |
| Censorship/captcha detection | Yes | No | N/A | Limited | Limited |
| Output formats | HTML/PDF/CSV/JSON/XMind | CSV/TXT | JSON list | HTML/CSV/JSON | Native graph + exports |
| Graph visualization | Built-in HTML | None | None | Basic | Industry-leading |
| Web UI | Local web app | None | Static site | Web UI | Desktop client |
| Permutations / variants | Yes | Limited | No | Module-dependent | Manual |
| Site definition format | JSON, declarative | JSON, declarative | JSON, declarative | Python modules | Proprietary transforms |
| Skill floor for first run | Low | Low | Very low (data only) | Medium | Medium-high |
| Skill ceiling for advanced use | Medium | Low | N/A | High | Very high |
| Suitability for stalkerware abuse | High (low friction) | Medium | Low (data only) | Medium | Low (cost barrier) |
The table tells a story we want to articulate explicitly. Maigret occupies a unique position: it has Maltego-class breadth of coverage and Maltego-style recursive dossier construction, but with Sherlock’s price tag, Sherlock’s installation footprint, and a lower skill floor than any of its peers. WhatsMyName is essentially a curated list of selectors maintained by the OSINT community; it is a data project that other tools consume. Sherlock is the direct ancestor and remains lighter and simpler. Spiderfoot is a more general framework that can do more things but does most of them less well than Maigret does its specific thing. Maltego is the commercial heavyweight, and its license cost has historically functioned as an informal access control — not a moral filter, but a friction layer. Maigret removes that friction.
That last row of the table — “suitability for stalkerware abuse” — is editorial, not technical, and we put it there deliberately. It is the row that tools of this class do not usually print in their feature comparisons, and we think they should.
Strengths And Concerns: The Dual-Use Problem Is The Story
Let us start with the strengths, because they are real and the project deserves credit for them. Maigret is fast, in the way that asyncio over aiohttp is fast when you write it well; a search across the default top-500 sites typically completes in under a minute on a competent connection. It is comprehensive, in a way that no other free tool currently matches. It is well-engineered, with a clean separation between site data and execution logic that makes the codebase pleasant to read and extend. It is portable, with no API keys to manage and no commercial backend to depend on. It produces output formats that meet investigators where they actually work — XMind in particular is a quiet signal that the maintainer understands his audience. It detects censorship and captcha pages and surfaces those signals to the user rather than silently producing wrong results. It supports proxies in a way that respects user-configured threat models. It is, by every technical metric we apply to GitHub Radar projects, excellent.
And then we have to talk about the concerns, because in this case the concerns are not a footnote — they are most of the article. The dual-use problem is the central feature of any tool that produces dossiers on people from public data, and we want to lay out our worries in order of severity.
Stalkerware substitution. The single largest concern is that Maigret functions, at the user-experience level, as a fully sufficient stalkerware tool for someone who wants to track a specific individual. The user does not need an API key. The user does not need a paid subscription. The user does not need technical sophistication beyond installing a Python package and running one command. The user gets a polished HTML report with photos, locations, and cross-platform identity links. We are not making a hypothetical argument here: the population of people who attempt to track ex-partners, estranged family members, and former colleagues is large, the tools they have historically used are commercial spyware products under increasing regulatory pressure, and the substitution effect from regulated commercial products to unregulated open-source equivalents is a known pattern. Maigret sits exactly where that substitution lands.
False-positive harm to subjects. Even when the operator has good intentions, the tool’s reports are presented with a confidence the underlying data does not always justify. A username collision — two different people who happen to have chosen the same handle on different platforms — produces a report that visually unifies them as a single person, with photos and bios juxtaposed as though they belonged to one identity. We have seen, in the wild, journalistic and investigative pieces that drew incorrect conclusions from exactly this failure mode. The harm here flows downhill: the subject of the misidentification has no recourse, no notification, and no opportunity to correct the record before action is taken on the false dossier.
Regulatory exposure for users. The README’s “educational and lawful purposes only” disclaimer is legally weak protection for someone using the tool in a jurisdiction with strong data protection law. The General Data Protection Regulation in the European Union, the California Consumer Privacy Act and its successors in the United States, the Personal Information Protection Law in China, and analogous frameworks elsewhere all impose obligations on the systematic collection and processing of personal data, including data that is technically public. Maigret’s output is, by any reasonable interpretation, the systematic processing of personal data. Operators who use the tool in professional contexts without considering their legal posture are taking on real exposure, and the tool itself does nothing to surface that exposure to the user.
Platform terms of service. Most of the sites Maigret queries explicitly prohibit automated scraping in their terms of service. This is not a moral problem so much as a contractual one, but it has practical consequences: a user whose behavior triggers a platform’s anti-automation defenses can find their own accounts on those platforms suspended, and at scale, this kind of activity contributes to the steady tightening of public-API access that has degraded the broader research ecosystem over the last five years. Every aggressive scraper is a small tax on the next legitimate researcher.
Maintainer concentration and supply chain. A single maintainer is the keeper of a site database that thousands of investigators depend on. We do not have evidence of any specific risk — soxoj has been a responsible steward of the project — but we observe that a tool of this consequence would benefit from a more distributed governance model. The MIT license guarantees the code can be forked; it does not guarantee that the curated site list can be kept current by the broader community in the maintainer’s absence.
Recursive scope creep. The recursive search feature is technically elegant and ethically slippery. The user inputs one username and consents, in some moral sense, to a search on that handle. Recursive expansion produces searches on derived handles that the user did not type and may not have known about, which means the dossier grows beyond the operator’s original mental model of what they were doing. This makes it easier to drift from “I am looking up one person” to “I have built a graph of associates,” which is a substantively different activity with substantively different ethical and legal implications.
None of these concerns argue that Maigret should not exist. They argue that Maigret should be discussed honestly. The OSINT community has a habit of celebrating capability and skipping the conversation about consequence, and we are not going to do that here.
Data Panel: Fifteen-Plus Metrics At A Glance
| Repository | soxoj/maigret |
| Tagline | Collect a dossier on a person by username from 3000+ sites |
| Primary language | Python |
| License | MIT |
| Stars | 21,671 |
| Stars added today | ~535 |
| Forks | 1,513 |
| Watchers | 21,671 |
| Subscribers | 126 |
| Open issues | 60 |
| Created | 2020-06-27 |
| Last push | 2026-04-30 |
| Last update | 2026-05-02 |
| Repository size | ~16.6 MB |
| Default branch | main |
| Discussions enabled | Yes |
| Wiki enabled | No |
| Site coverage | 3,000+ supported, 500 default |
| Output formats | HTML, PDF, CSV, JSON, XMind |
| Proxy / Tor / I2P | All supported natively |
| API keys required | None |
| Documentation | maigret.readthedocs.io |
| Topics declared | blueteam, redteam, osint, pentesting, socmint, reconnaissance, namechecker, investigation, cybersecurity, infosec, scraping, sherlock, social-network, identification, python, python3, cli, open-source, osint-framework, osint-python |
| Maintainer | soxoj (single primary maintainer) |
| Recursion / permutation | Both, on by default |
| Web UI | Yes, local |
| Censorship / captcha detection | Yes |
| Activation mechanism | Yes, supports cookie/JWT/header injection |
ThesisBench Verdict: Four Audiences, Four Different Answers
We never give a single verdict on a tool of this category, because the right answer depends entirely on who is asking. Below we lay out our position for the four audiences who plausibly arrive at this article.
For OSINT researchers and trust-and-safety analysts
Maigret is, on a pure capability basis, the strongest free option in its category. We recommend adopting it, with two operational caveats. First, treat its output as a starting point for human verification, not a finished product — the false-positive rate on username collisions is non-trivial, and the polished report format makes errors look authoritative. Second, document your authorization. Whether you work in a corporate trust-and-safety function, a journalism organization, an academic research group, or as an independent investigator, your protection against regulatory and reputational risk is a clear paper trail of why a given search was conducted, what investigative purpose it served, and what data minimization you applied to the results. Maigret will not generate that paper trail for you. You have to do it yourself, every time, and you should integrate the discipline into your workflow before you integrate the tool.
For pentesters and red teams
Maigret belongs in your reconnaissance toolkit, full stop. Username enumeration is a foundational pre-engagement step, and the breadth of coverage Maigret offers is a meaningful upgrade over the alternatives. We would, however, push back gently on the temptation to run it without scoping. Your engagement letter authorizes you to test specific targets. Recursive identity expansion can pull associates of those targets into your dossier, and those associates are not in scope. Configure the tool to disable recursion when scope is narrow, and document the configuration in your engagement notes so that the deliverable to your client matches the authorization you actually held.
For defenders, blue teams, and platform integrity engineers
The most useful frame for defenders is to treat Maigret as a model of what your adversaries are running against your users. Read the source. Look at the site database. Understand which fields in your platform’s profile pages are being parsed and what cross-correlation signals are being lifted from them. Then ask whether your platform is leaking more identity than it needs to. Public profile pages that helpfully expose stable numeric IDs, registration timestamps, and external links are giving Maigret — and every other tool in this class — exactly the affordances that turn a username into a dossier. Some of that exposure is product-essential; much of it is not. The defender’s read of Maigret is a checklist of attack surface to evaluate.
For journalists and human rights investigators
This is the audience we worry most about, because the work is most consequential and the tooling is most easily misused. Maigret can be transformative for accountability journalism — tracing the digital footprints of corrupt officials, mapping disinformation networks, identifying perpetrators of online harassment campaigns. It can also be deployed against vulnerable subjects in ways that endanger them. Our recommendation is that any newsroom or human rights organization adopting Maigret should pair the technical adoption with a written use policy, an explicit subjects-of-investigation criteria framework, an internal review step for any output that names a private individual, and a retention and deletion schedule for the dossiers it produces. Tools shape behavior. A tool this capable, used without an institutional framework, will produce institutional accidents.
And for everyone else
If you do not fall into one of the four audiences above — if you are reading this because you are curious, or because you want to look up an old acquaintance, or because someone online made you angry — we are going to be unusually direct. Do not download this tool. The capability it offers is not the capability you think you want, the report it produces will tempt you into conclusions the data does not support, and the harm vector points entirely at the person on the other end of your search. There are better ways to satisfy curiosity. Maigret is not one of them.
Our final word, the one we want to leave on the page after the technical praise and the comparative tables and the data panel, is this: Maigret is a beautifully built instrument for an activity that is sometimes necessary and frequently dangerous. The engineering is excellent. The community is real. The site database is a community asset of meaningful value. And the moral weight of using it sits entirely on the operator, because the tool itself is morally inert and the documentation, however well-intentioned, cannot distinguish a researcher from a stalker at the moment a command is typed. We will keep watching the project. We will keep recommending it, conditionally, to the audiences who can use it responsibly. And we will keep writing the disclaimer, because the disclaimer is the article.
Discussion