Example input: octocat.
OSINT.dev checks a bounded set of public profile URLs using detection rules derived from the community-maintained WhatsMyName dataset.
Coverage
The first production wave uses 12 audited GET-only sites selected from WhatsMyName commit 062bcfe48df79fa618e96edc79dc9673f3fe5643 (2026-09-16). The runtime does not execute the complete mutable upstream catalog.
This keeps execution bounded and auditable:
- maximum 12 sites per run;
- six concurrent requests;
- public HTTP(S) only through OSINT.dev network-safety controls;
- no POST rules;
- no authenticated or login-gated checks;
- no NSFW sources;
- no arbitrary URL supplied by the user or a mutable upstream dataset.
Interpretation
A positive result means the pinned WhatsMyName detection rule matched the public response for that username. It is a candidate profile URL, not proof that a real person controls the account and not proof that profiles on different services belong to the same person.
A negative or inconclusive response is not proof that an account does not exist or that a username is available. Websites and detection rules change over time, and anti-automation behavior can make a check inconclusive.
Source and license
Detection rules in this bounded snapshot are derived from WebBreacher/WhatsMyName wmn-data.json, commit 062bcfe48df79fa618e96edc79dc9673f3fe5643.
WhatsMyName data: Copyright (C) 2015-2026 Micah Hoffman and contributors. Licensed under CC BY-SA 4.0.