soxoj/maigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Cross-reference a dev's username across 3,000+ sites before you ape into their token.
Turn what you learned into a concrete stack decision.
Want the shortlist in your inbox?
Subscribe for the weekly brief that turns new AI noise into the few tools and workflows worth testing.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
You've spent 45 minutes reading a tokenomics doc. Vesting schedules, emission curves, the whole thing. Then you spend zero minutes checking whether the "lead dev" behind the project has a history of doing this exact thing before, under a different name, with a different token that went to zero.
That's backwards. Tokenomics can be copy-pasted from a template in an afternoon. A dev's track record can't be faked as easily — if you know where to look. Maigret is a free, open-source OSINT tool that takes a single username and checks it against 3,000+ sites in one pass: GitHub, Reddit, Discord-adjacent forums, Telegram-linked services, old blogs, dating sites, pastebins, you name it. Point it at a dev's GitHub handle and see what else that handle touched.
This isn't a magic rug-detector. It's a research multiplier. What used to take you an hour of manually checking usernames on 15 platforms now takes a few minutes, and it surfaces accounts you wouldn't have thought to check manually.
Maigret is a username reconnaissance tool — you give it a handle, it queries thousands of sites to see if an account with that exact (or similar) username exists, then reports back with confidence scores and profile data where available. It's a spiritual successor to Sherlock, but with a much bigger site database, HTML parsing to reduce false positives, and the ability to generate a graphical report (HTML/PDF) instead of a wall of terminal text.
For crypto due diligence specifically, the workflow is: take the one identifier a project actually gives you — a GitHub handle, a Twitter/X handle, a Discord username — and see what else it's connected to. Anon devs are usually anon on the project's official channels, but they didn't spring into existence yesterday. They have old accounts. Sometimes those old accounts are still logged into a Discord server for a token that rugged in 2022.
Let's say a new DeFi project just launched. The whitepaper credits "0xkryptonite" as lead dev, and their GitHub profile is the only public trace of them — no LinkedIn, no personal site, nothing.
Step 1 — Install Maigret.
pip3 install maigret
Or run it without installing anything, via Docker:
docker run -v $(pwd)/reports:/app/reports soxoj/maigret 0xkryptonite --html
Step 2 — Run the search.
maigret 0xkryptonite --html --pdf
This checks the handle across the full site list (you can narrow it with --top-sites 500 if you want a faster, higher-confidence-only pass). It'll take a couple minutes depending on connection speed and how many sites you're querying.
Step 3 — Read the report.
Maigret spits out a report showing every site where an account with that exact username exists, tagged with confidence level (claimed vs. exact match). In this hypothetical, say the report shows hits on:
u/0xkryptonite, active 2021-2022, posting almost exclusively in r/CryptoMoonShots and a subreddit for a specific tokenStep 4 — Pivot. That Reddit history is the payoff. You now have a timeline and a token name to search. Cross-reference that token on-chain (contract still exists, holder count, whether liquidity was pulled) and on X. If it turns out that token's liquidity was drained six weeks after launch and the same handle went quiet right after — that's not proof of anything criminal, but it's a data point you didn't have 10 minutes ago, and it's the kind of thing that should show up in your DD notes before it shows up in a "we got rugged again" thread.
Total time: under 15 minutes for a search that would've taken an hour of manual site-by-site checking, if you even thought to check half those platforms.
The obvious alternative is manually Googling the handle plus "crypto," "rug," "scam," or checking it by hand on the 5-6 platforms you always think of (Twitter, GitHub, LinkedIn, Discord, Telegram). That works fine for famous or semi-doxxed devs where there's already public discussion. Maigret earns its keep on the anon or semi-anon dev — the one with no LinkedIn, no verified identity, just a handle and a promise.
| | Manual search | Maigret | |---|---|---| | Time | 30-60 min for a handful of sites | 2-10 min for 3,000+ sites | | Coverage | Limited to sites you remember | Broad, including obscure/regional platforms | | False positives | Low (you're eyeballing each one) | Moderate — verify hits manually | | Good for | Devs with existing public presence | Anon/pseudonymous devs, cross-project tracing | | Cost | Free, your time | Free, open source |
Skip it entirely if the project already has doxxed, KYC'd founders with a verifiable history — Maigret adds nothing there. It's built for exactly one scenario: someone gave you a username and nothing else.
Trusting every hit as confirmed. Maigret flags possible matches, not proven identity. A shared username on a site with millions of users can absolutely be two different people. Click through and verify — check bio text, posting history, profile pictures, dates — before you treat it as the same person.
Only checking the handle they gave you. If the GitHub handle traces to a Reddit account, check that Reddit account's post history for other usernames they've mentioned or linked. OSINT is chained, not single-hop. One good pivot usually leads to two more.
Skipping the on-chain half. Finding a sketchy old Reddit account is a lead, not a verdict. Pair it with actual on-chain checks — old contract addresses, LP lock status, prior holder distribution — before you draw a conclusion. Username correlation tells you who they might be; on-chain data tells you what they actually did.
Running it once and calling it done. New accounts get indexed by search engines and cached scrapers on a delay. If a project is brand new, the trail might still be thin. Re-run the check a week or two later, especially if the dev starts posting more publicly as the project gains traction.
Yes — it only queries publicly available account existence data, the same information you could find by manually visiting each site and checking if a username is taken. It's the automation that's fast, not the access method that's novel.
Not directly. It finds linked usernames and public profile data. Any identity or wallet connection comes from you manually cross-referencing what it surfaces — a bio, a linked email, a reused handle on a KYC'd exchange profile page, etc.
Then Maigret won't find much, and that's itself informative — a genuinely careful anon operator with zero handle reuse is either very disciplined or very new to being anon. In that case, lean harder on on-chain analysis and social graph checks (who they follow, who follows them, who vouches for them) instead.
→ Ask the index what to build your osint stack
→ Free credits for these tools
Written by McKlaud AI. Want to know which AI tools actually fit your business? Get a free AI audit.