user-scanner

Product Introduction

1. Definition: User-scanner is a Python-based, open-source OSINT (Open-Source Intelligence) and digital footprinting suite. It is a technical reconnaissance tool engineered for deep email and username intelligence.
2. Core Value Proposition: It solves the critical problem of fragmented online investigations by providing a unified, automated engine to map a target's digital footprint across 455+ online platforms from a single identifier. Its primary value is in delivering comprehensive OSINT data for security research, threat intelligence, and professional investigations.

Main Features

1. Deep Email & Username OSINT Engine: The tool operates on two primary vectors. Its email intelligence module checks for account registrations across 175+ platforms, while its username profiling module scans 280+ social media, developer, gaming, and shopping sites. It works by sending HTTP/HTTPS requests using the httpx and curl_cffi libraries, which provide high concurrency and TLS fingerprint impersonation to bypass basic anti-bot measures.
2. Cross-Scan & Recursive Pivot Intelligence: This is an advanced reconnaissance feature. After an initial scan, the engine mines exposed data (like handles, profile links, or secondary emails) from the results and automatically launches new scans on those discovered vectors. For example, an email scan (-e) can pivot to find usernames, and a username scan (-u) can pivot to find associated emails or other aliases, enabling multi-hop investigation.
3. Model Context Protocol (MCP) Server Integration: This feature allows AI agents (like those in Claude Desktop or Cursor) to directly use user-scanner as a tool. The MCP server exposes functions like scan_username and scan_email, enabling LLMs to autonomously conduct and chain OSINT investigations, making it a force multiplier for AI-powered security analysis.
4. Hudson Rock Infostealer Breach Intelligence: By using the --hudson flag, the tool can query the Hudson Rock database for infostealer malware logs. This checks if a target's credentials (email/username) have been exposed in real-world cybercrime breaches, providing high-fidelity threat intelligence beyond simple account existence.
5. High-Throughput Parallel Scanning with Proxy Support: Built for speed and anonymity, the engine uses asynchronous parallel processing. It supports proxy rotation from a list (-P) with auto-detection of protocols (HTTP, SOCKS5) and includes a --validate-proxies flag for pre-scan health checks, essential for large-scale or sensitive operations.

Problems Solved

1. Pain Point: Manual, time-consuming, and incomplete digital footprinting. Investigators traditionally visit dozens of sites individually, a process prone to human error and coverage gaps.
2. Target Audience: Security Researchers, Threat Intelligence Analysts, Penetration Testers (Red Teams), Digital Forensics Investigators, Corporate Security Teams, and Ethical Hackers conducting authorized assessments.
3. Use Cases: Pre-engagement reconnaissance for penetration tests, background checks on individuals of interest, monitoring for corporate credential exposure, investigating impersonation or fraud, and building attacker profiles for threat hunting.

Unique Advantages

1. Differentiation: Unlike simple "username checkers," user-scanner is a full OSINT suite. It combines breadth (455+ vectors) with depth (metadata scraping, cross-pivoting, breach intel). It goes beyond binary "found/not found" results to extract rich profile data like avatars, bios, and follower counts.
2. Key Innovation: Its recursive cross-scan engine is a significant innovation. By automatically pivoting on discovered data, it mimics and automates the logical steps of a human investigator, transforming a single point of data into a connected web of intelligence. The native MCP Server integration is also a forward-looking feature that bridges OSINT automation with the emerging AI agent ecosystem.

Frequently Asked Questions (FAQ)

1. Is user-scanner legal to use? User-scanner is a tool for gathering publicly available information (OSINT). Its legality depends on your jurisdiction, intent, and authorization. It is designed for ethical security research, authorized penetration testing, and defensive investigations. Always ensure you have proper authorization before scanning targets.
2. How accurate is user-scanner's scan results? Accuracy is high but not 100%. It depends on website availability, anti-bot measures (which curl_cffi helps bypass), and profile visibility settings. The --cross-scan feature improves accuracy by correlating data from multiple sources. Results should be considered leads for verification.
3. Can user-scanner bypass login walls or private profiles? No. user-scanner only checks for the public existence of profiles and scrapes publicly viewable metadata. It cannot access private information, bypass authentication, or hack into accounts. It operates within the bounds of publicly accessible data.
4. What's the difference between an email scan and a username scan? An email scan (-e) verifies where a specific email address is registered as an account. A username scan (-u) profiles where a specific username/handle is used. The --cross-scan feature links these two, often finding a username from an email scan or vice-versa.
5. How does user-scanner compare to paid OSINT platforms like Maltego or SpiderFoot? user-scanner is a focused, command-line tool specializing in email/username reconnaissance. It is free, open-source, and highly scriptable. While commercial tools may offer broader data source integration and GUI workflows, user-scanner excels in depth, automation, and cost-effectiveness for its specific use case.