Online Scams & Username Investigation Guide

1. Username Investigations (Alias Hunting)

Scammers are creatures of habit. They often reuse the same username—or close variations of it—across dating apps, social media, forums, and payment platforms. Investigating these aliases can help link multiple fraudulent identities back to a single source.

Automated Enumeration

Instead of searching platforms individually, utilize automated tools to ping hundreds of sites simultaneously to identify where an alias is registered:

• Maigret: A command-line tool that searches over 3,000 sites, extracts profile details, parses bios, and recursively maps connected accounts to build an identity network.
• Sherlock: A highly reliable command-line tool checking roughly 480 platforms.
• WhatsMyName App: A fast, web-based alternative for immediate username checks without a terminal environment.

Pivoting Strategy

Once an active profile is located on a secondary platform, analyze the account for localized clues: locations, hobbies, writing style, or mentions of other contact info.

2. Email Address Investigations (Reverse Lookups)

An email address is a critical pivot point in digital forensics. The objective is to turn a bare email address into a verified identity, real name, or geographic location.

Social & App Association

Tools like Epieos allow investigators to check emails against Google services and dozens of major platforms without alerting the target, retrieving:

• The target’s real name and profile photo registered to their Google account.
• Google Maps reviews (revealing locations they have physically visited).
• Other platforms (Skype, Microsoft, social media) linked to that email.

Breach Data & Timeline Analysis

Querying breach indexes (such as DeHashed or HaveIBeenPwned) can reveal if the email was leaked in historical data breaches, helping prove account longevity, age of active scams, and historical password/username reuse.

3. Romance & Online Dating Scams

Romance scams rely heavily on emotional manipulation and stolen visual identities. Investigators must use advanced verification workflows to determine if an online partner is genuine.

Facial Recognition & Image Forensics

Scammers frequently steal photos from public profiles or influencers. Advanced engines can identify duplicate visual profiles across the internet:

• PimEyes / FaceCheck.ID: Highly effective reverse-face search engines used to find every online instance of a specific face, revealing the real person behind the stolen photos.
• EXIF Metadata Analysis: If raw images are sent directly, utilize ExifTool to check for embedded GPS coordinates, camera models, and original creation dates.

Linguistic and Script Analysis

Romance scammers often use copy-and-paste scripts. Searching for exact phrases from their messages on search engines can reveal matches in scam-reporting forums, proving the scam pattern.

Methodology Cheat Sheet

Investigation Step

Objective

Primary Tools

1. Assess Alias

Find where else they operate online

Maigret, WhatsMyName, Sherlock

2. Assess Email

Extract real names, locations, and linked apps

Epieos, DeHashed, HaveIBeenPwned

3. Assess Photos

Verify if the identity is stolen / find the real person

PimEyes, FaceCheck.ID, Lenso.ai

4. Infrastructure Check

Identify custom domains or scam hosting networks

Reverse WHOIS, DNSDumpster

To learn more: