Username search benchmark: findings, evidence and limitations

Updated 1 November 2026 · MyRecon editorial

In a recorded search for 4ryanwalia on 30 September 2026, MyRecon reported 12 hits, Sherlock 19 and Maigret 35. Reviewing the unique profile addresses supported 12, 11 and 10 leads respectively. On the 210 exact addresses checked by all three engines, the supported counts were 8, 9 and 9. Those two views answer different questions; neither establishes an overall accuracy ranking.

Published and reviewed: 1 November 2026 by MyRecon. This is a publisher-run study of our own product and competing tools. The September observations are historical; publishing this article did not rerun those scans. A separate daily control sample is dated below. A supported public profile is a research lead, not proof of ownership or username availability.

Findings from the full-catalogue case study

Expanded original testing, 1 November 2026: the 35-control study across eight platforms adds platform-specific upstream testing fixtures and generated candidates, with current reference verification, all tool outcomes, pinned versions, a CSV and a downloadable evidence ZIP. Its sample and scored denominators are separate from the historical case below.

The same owner-supplied handle was searched using each engine's recorded catalogue configuration. Catalogue sizes and detection rules differ. The table counts native reported hits, including positive outcomes later quarantined by HTTP-error normalization. Source review counts each profile address once, so Sherlock's duplicate is separated from its 18 unique leads.

Supported means the recorded source evidence supports that exact public profile. Contradicted means evidence such as explicit absence or a different handle contradicts the reported lead; these are observed false positives. Unverified leads remain unresolved and are not counted as false positives. Unknown checks describe engine outcomes across the catalogue, including blocked or failed requests; they are a different population from unverified reported leads.

Maigret returned the most unique leads, with 16 still unresolved. MyRecon had no source-contradicted reported leads in its final recorded run, but 244 checks remained unknown. The source review does not establish a truth label for every catalogue negative, so this table cannot support a whole-catalogue accuracy, recall or false-positive rate. The normalized evidence file contains individual checks, reported addresses, reference observations and their timestamps.

Results on 210 shared profile addresses

This view intersects exact profile addresses checked by MyRecon, Sherlock and Maigret. It reuses the full-run measurements; it is not another scan. Normalization removes www and trailing slashes and recognizes the recorded Buy Me a Coffee redirect. Different URL schemes and endpoint paths are not assumed equivalent. Repeated checks of an address are consolidated in the checked-address total.

Sherlock and Maigret each returned one more supported lead than MyRecon on these shared addresses. For example, both reported the OpenStreetMap profile, while MyRecon's full scan received HTTP 429 and kept that check unknown. A separate source review supported the profile's existence. That review does not retroactively turn the blocked engine result into a successful detection.

Observation dates, versions and configuration

All three local engines ran on the same workstation on 30 September 2026. Some runs overlapped. The source reviews were also recorded on that date, at different times from the scans. The following durations are recorded measurements, not a speed ranking; catalogue sizes, concurrency and responses differed.

The MyRecon run records commit 0749d334 and separate engine, profile-identity and database SHA-256 hashes. Sherlock is pinned to e40a45ec; Maigret to b6642744. The third-party runs record Python 3.12.14 and Requests 2.34.2, with parsing, enrichment and retries disabled. Full revisions and database hashes are retained in the evidence.

The main Sherlock comparison honors the upstream exclusion list recorded with SHA-256 afe72771173260f71c1dc965b4dfeb503060e15406e75e0c815b608efd2e722d. A separate unfiltered diagnostic reported 59 hits, 40 on sites removed by that list. Its 481 checks and 58 unique leads belong to the diagnostic and are not substituted into the main table. A future upstream exclusion list can change the result even with the same pinned engine.

What the OSINTsearch preview exposed

The public OSINTsearch preview was observed at 15:35:44 UTC on 30 September 2026, with the user completing the CAPTCHA. It displayed 753 endpoints checked, 21 endpoint hits and 19 grouped matches. These are different units. It named 14 platforms and hid five matches; every profile URL was hidden. Those results cannot be scored as supported or contradicted, or placed in the shared-address comparison.

The named platforms were Instagram, GitHub, YouTube, Pinterest, Twitter (X), Reddit, Buy Me a Coffee, Periscope, HackerOne, Hacker News, Docker Hub, Product Hunt, VirusTotal and Replit. The displayed 15 seconds was the provider's timer, not an independently measured result. See the captured preview and the original query; the current service may differ from the capture.

Methodology and evidence rules

1. Use one explicitly supplied public handle. Run the standard MyRecon catalogue, Sherlock with its recorded upstream exclusions, Maigret's enabled unprotected username catalogue, and the separately observed OSINTsearch free preview. No customer history, private content, credentials or breach data enter this case study.
2. Keep native outcomes. Preserve positive native verdicts, duplicates, normalized unknown outcomes and HTTP status codes. A tool's reported hit remains visible even when HTTP-error normalization quarantines it.
3. Review sources separately. Use typed official API account objects, explicit missing responses, a different account handle, or separately recorded profile identity and missing-control observations. HTTP 200, agreement between tools, a challenge and a login wall do not establish existence. Parking destinations contradict a public-profile lead, without establishing whether an account ever existed.
4. Score only supported evidence. Classify each unique reported address as supported, contradicted or unverified. Keep duplicates separate. Contradicted counts are observed lower bounds on false positives, and unresolved results remain unresolved. Do not infer common ownership.
5. Compare both scopes. Show each complete recorded run and the exact-address intersection. Keep the hidden preview results outside address-level scoring.

Corrections retained in the evidence

The initial MyRecon run reported 13 hits, with 12 supported leads and one contradicted lead: the requested RubyGems URL resolved to the fermion profile. A digit-prefixed path could be interpreted as a numeric account ID. An exact-handle check was added and the full engine rerun. The final RubyGems check remained ambiguous rather than being reported as a match. The original error remains in the recorded inputs.

A subsequent run before recovery reported 11 supported hits. General rules were added for exact active Buy Me a Coffee creator records, exact OpenStreetMap profile identity, and typed Reddit account objects. The final full run recovered Buy Me a Coffee, bringing the supported total to 12. OpenStreetMap passed a direct check but was blocked during the full run; Reddit was challenged locally. Those engine outcomes remain unknown even where a separate source review supports the profiles. The rules apply to arbitrary handles and do not use a saved result for this account.

Separate daily controls: 1 November 2026 snapshot

The scheduled regression sample is a different experiment: ten fixed usernames across GitHub, GitLab and Hacker News, for 30 username-platform checks per engine. This article freezes the run from 10:38:27 to 10:39:01 UTC on 1 November 2026. It ran on GitHub Actions with the application cache bypassed. Future daily updates do not change this dated table.

Accuracy = (TP + TN) / (TP + TN + FP + FN). Coverage = scored checks / all 30 checks. False-positive rate = FP / (FP + TN), using only definitive predictions on known reference negatives. Unknown predictions and unknown reference truth do not enter accuracy; unknown reference truth is unscored. The HTTP 200 heuristic had 13 unknown reference-negative predictions, outside its six scored negatives. Read accuracy alongside coverage. A status-only heuristic is not a named competitor engine.

The controls are torvalds, octocat, defunkt, mojombo, sindresorhus, and five synthetic handles: mrbench-a7b32c91d8e04f6a, mrbench-b9e61d03a4c72f85, mrbench-c4f82a16b9d03e57, mrbench-d6a91e38c2b74f05 and mrbench-e2c57b90d4a16f83. Reference truth is checked from typed official API objects or explicit absence, rather than assuming the synthetic handles must be absent.

This run records MyRecon commit c7519795, the same pinned Sherlock and Maigret revisions linked above, up to three concurrent platform checks, and an eight-second timeout for the third-party engines. MyRecon uses six-second connect and eight-second read timeouts with a 45-second sweep deadline. Endpoints, headers and validation differ. Some reference evidence is shared with MyRecon's production API logic, so this is a small regression sample, not an independent accuracy audit. The 100% values describe only these definitive checks. See the frozen daily evidence revision or the latest daily data and history.

Limitations and interpretation

• Selection and publisher bias: one owner-requested handle and a small fixed control set do not represent all usernames, services or network conditions. MyRecon runs and publishes this comparison.
• Missing truth and blocked checks: no contradicted reported leads is not a zero-error guarantee. Unknown engine outcomes can conceal missed profiles, and unverified leads may later be supported or contradicted.
• Time and configuration: platform responses may change between scans and verification. Catalogue coverage, exclusions, endpoints, concurrency and overlapping local runs prevent a controlled speed ranking.
• Corrections used this case: the final MyRecon run follows fixes informed by the observed handle mismatch and missing profiles. It is not an untouched, held-out evaluation. Earlier results are retained for review.
• Hidden preview evidence: five OSINTsearch matches and all its profile URLs were hidden. No accuracy or identity inference is made for them.
• Scope of a lead: a matching public handle does not confirm identity, common ownership, registration availability or access to private information.

Reproduce and inspect the evidence

Use Python 3.12 in an isolated environment and install Requests plus backend/tools/requirements-benchmark.txt. The requirements pin the third-party source revisions. Run the following from the repository root:

python backend/tools/username_benchmark.py --username 4ryanwalia --output-dir output/benchmark-4ryanwalia
python backend/tools/review_username_benchmark.py --username 4ryanwalia --output-dir output/benchmark-4ryanwalia
python backend/tools/review_profile_controls.py --username 4ryanwalia --output-dir output/benchmark-4ryanwalia
python backend/tools/build_username_benchmark.py --input-dir output/benchmark-4ryanwalia --output frontend/data/username-benchmark.json

The builder also needs the recorded auxiliary inputs: the OSINTsearch preview, earlier MyRecon runs, source-review observations and unfiltered Sherlock diagnostic. Save each top-level item using its corresponding JSON filename in the output directory. Preserve fresh measurements when rerunning engines. Reusing a recorded review preserves its original date and does not constitute fresh verification. No authentication, proxies, retries or block bypass were used in the recorded local comparison.

For the separate daily sample, run python backend/tools/daily_benchmark.py --require-named-tools after installing its dependencies; the recorded workflow documents the GitHub Actions environment. New runs may differ as services and exclusion lists change.

Evidence and source code: frozen case-study evidence revision · public normalized case-study data · reproduction notes and downloads · interactive homepage comparison. The findings and tables on this page are included in the HTML and can be read without running JavaScript.

More from the MyRecon blog · Browse all guides