Skip to main content
Thirdwatchthirdwatch
Social media

Monitor Lookalike Usernames for Impersonation

Check several lookalike username variants at once — catch squatter and impersonator registrations early.

Sep 16, 2026 · 2 min read · 490 words
See the scraper →

Impersonators register the near-miss variants — check them as a set. Thirdwatch's Username OSINT Scraper checks a username across 40+ platforms in one run and returns a per-site verdict with the profile URL — GitHub to Reddit to Keybase.

Skip the setup: Run this as a ready-to-go task on Apify — pre-loaded with the configuration from this guide.

Why monitor lookalike handles

Impersonation doesn't take your exact handle — it takes yourname_dev, yourname.official, yournamehq. The monitoring set is the variant list, not the single name.

usernames takes the whole variant list; each username × site combination returns its own row.

The checker resolves each platform's profile URL pattern and reports the verdict with the HTTP status behind it — one run replaces an afternoon of tab-checking.

How does this compare to the alternatives?

Approach Cost model Coverage Effort
Sherlock-style CLI tools Free, your infra Wide but rate-limit-prone You run and maintain it
Manual site-by-site check Analyst hours Whatever you remember to check Hours per username
Thirdwatch Username OSINT Scraper Pay per check row 40+ platforms, one run Paste a username, run

Why this Actor

  • 40+ platforms per run — code, social, creator, and niche sites in one sweep.
  • Clean verdicts per site: exists, not_found, or error — never ambiguous.
  • profileUrl gives the canonical link when the account exists.
  • httpStatus exposes the evidence behind each verdict.
  • Bulk input — a watchlist of usernames runs in one go.

How to do it in 3 steps

Step 1: Configure the input

Set the inputs as shown below — usernames takes the targets, sites restricts the sweep to a subset — omit it to check all 40+ supported platforms.

Step 2: Run the Actor

Run it from the console, the API, or the linked saved task. One dataset row is written per site check.

Step 3: Use the output

Each row carries username, site, a status verdict (exists/not_found/error), the profileUrl when found, and the httpStatus behind the verdict.

{
  "usernames": [
    "pushpak",
    "pushpak_dev",
    "pushpak.dev"
  ]
}

Each dataset row looks like:

{
  "username": "pushpak",
  "site": "github",
  "status": "exists",
  "profileUrl": "https://github.com/pushpak",
  "httpStatus": 200
}

What to watch for

Verdicts are status-code based — a handful of sites rate-limit aggressively and may return error rows under load; retry those rather than counting them as absent. exists proves the handle is registered, not who owns it.

Related use cases

Run the Username OSINT Scraper on Apify Store — pay per result, free to try, no credit card to test.

Frequently asked questions

Which sites are covered?

40+ platforms including GitHub, GitLab, npm, PyPI, Docker Hub, Reddit, Instagram, YouTube, Twitch, Pinterest, Medium, Substack, Patreon, Keybase, Kaggle, Steam, and more.

What does `error` status mean?

The check couldn't be completed — usually a rate limit or a site change. Retry those rows rather than reading them as `not_found`.

Does `exists` mean it's the same person?

No — it means the username resolves on that site. Identity correlation across sites is your downstream analysis step.

Can I check only specific sites?

Yes — `sites` takes a list of site keys to restrict the sweep.

Is this useful for brand protection?

Yes — that's the second main use: check your brand handle across all platforms for squatters and impersonators.

How does detection work?

Per-site status-code and redirect checks — the same signal a human gets loading the profile URL, applied at scale.

Related

Try it yourself

100 free credits, no credit card.

About 30 real searches. Add the MCP to Claude or Cursor in two minutes.