I built a free, open source username checker that re-tests every hit against fake usernames on the same site.

I’m the developer of Helix. False positives in username searches have cost me time, so I built it around one check.

When a site reports an account, Helix immediately asks the same site for two usernames that cannot exist. If the site “finds” those too, it’s a catch-all and the hit is dropped. A hit is kept only if it reproduces and both fake names get a clear “no such user”.

How it differs from Sherlock / Maigret / WhatsMyName: it runs all three databases together plus 3,683 Mastodon, Misskey, Lemmy and PeerTube servers (about 12,000 sites with `–all`), and instead of trusting each site’s rule it makes every site prove, live, that it can tell a real account from a fake one.

Numbers: a made-up username across the full database got 72 “accounts” with the check off and 0 with it on. A reader’s scan later found one false positive (OLX.pl, which keys user pages by seller id); it’s fixed in 3.6.1, and three new full scans of made-up names came back with 0.

Other things investigators may care about:

* Sites it couldn’t check (bot checks, timeouts, 403s) are listed as not checked, not counted as “no account”.

* Each account gets a HIGH, MEDIUM or LOW identity grade from independent evidence. A username match alone is LOW.

* `–save-pages` keeps the exact page behind every hit, hashed and timestamped. `–record-attempt` seals the whole scan.

* `–tor` / `–proxy` with remote DNS.

Free, MIT licensed: https://github.com/thalha-a9/helix (`pipx install helix-osint`, also on Docker and listed in awesome-osint)

Write-up with the method and numbers: https://dev.to/thalha-a9/how-i-got-false-positives-in-username-search-down-to-zero-across-11988-sites-429o

Feedback welcome, especially any site where it reports an account that doesn’t exist.