When mapping digital footprints, security analysts and open-source intelligence (OSINT) practitioners rely heavily on registration checkers. For years, single-purpose utilities like Holehe were the industry standard for checking email recovery endpoints. However, modern target profiling requires deeper correlation, higher concurrency, and cross-platform pivoting across both emails and usernames.
Enter user-scanner—a high-throughput, 2-in-1 Python OSINT engine designed for deep email registration checking, username profiling, and cross-scan intelligence.
Technical Comparison: user-scanner vs. Legacy OSINT Tools
Feature / Capability
Holehe
Sherlock / Maigret
user-scanner
Primary Input Vectors
Email Only
Username Only
2-in-1 (380+ Combined Vectors)
Target Integration
~120 Email Sites
Scrapes Web Forms
155+ Email & 225+ Username Sites
Pivoting / Cross-Scanning
❌ No
❌ No
✅ Auto-Pivots (Email ↔ Username ↔ Links)
Breach Intelligence
❌ No
❌ No
✅ Hudson Rock Infostealer API (--hudson)
Engine Core
Basic Async
Basic Requests
httpx + curl_cffi (TLS Impersonation)
Reporting Formats
CLI / JSON
CLI / CSV / HTML
PDF (with Media/Avatars), JSON, CSV
Deployment / Ecosystem
Pip
Pip
Pip, Virtual Env, Nix (nix run)
Core Capabilities of user-scanner
1. Cross-Scan & Pivot Intelligence Engine
Unlike legacy checkers that stop after returning a boolean hit, user-scanner features an automated cross-scanning engine (--cross-scan). It mines exposed handles, profile links, and secondary email addresses from initial scan metadata and recursively pivots across secondary target vectors.
-
-e→ Username: Extracts handles or social links exposed on an email’s registered profile. -
-u→ Email: Extracts public email addresses published on target profile pages. -
Multi-Depth Chains: Supports configurable chain depth (
--cross-depth) and link validation rules (--cross-links verified).
2. Infostealer Breach Intelligence (--hudson)
Integrates directly with Hudson Rock’s infostealer malware infection logs. Running --hudson alongside an email or username scan instantly correlates targets against compromise logs and malware-exfiltrated credentials.
3. High-Throughput Request Engine & Anti-Blocking
Built on top of httpx and curl_cffi, user-scanner utilizes automated TLS fingerprint impersonation to defeat basic web application firewalls (WAFs) and rate-limiting. It includes built-in proxy rotation with protocol auto-detection (http, socks5) and health validation (--validate-proxies).
Quickstart Usage Examples
Single & Cross-Scan Pivot Execution
# Basic email scan
user-scanner -e [email protected]
# Deep pivot scan: extract handles & secondary emails up to 2 hops deep
user-scanner -e [email protected] --cross-scan --cross-depth 2
# Username scan with Infostealer Malware Breach check
user-scanner -u targetuser --hudson
Enter fullscreen mode Exit fullscreen mode
High-Concurrency Output & Reporting
# Execute with custom concurrency and generate a visual PDF report
user-scanner -u targetuser -C 100 -f pdf -o report.pdf
# Rotate proxies with pre-scan health validation
user-scanner -u targetuser -P proxies.txt --validate-proxies
Enter fullscreen mode Exit fullscreen mode
Direct Python Integration (Library Mode)
import asyncio
from user_scanner.core import engine
from user_scanner.email_scan.shopping import etsy
async def main():
result = await engine.check(etsy, "[email protected]")
print(result.to_json())
asyncio.run(main())
Enter fullscreen mode Exit fullscreen mode
Conclusion
For OSINT researchers looking for an active, modern, and extensible successor to Holehe, user-scanner offers a comprehensive solution. By pairing email enumeration with username profiling, TLS fingerprinting, infostealer intel, and recursive cross-scanning, it streamlines digital footprinting into a single CLI tool.