What Maigret Actually Does — And How Far It Reaches

Maigret takes a single username and runs it against more than 3,000 websites simultaneously, pulling back every profile it finds and assembling the results into a structured dossier on the person behind that handle. Forum accounts, social media bios, gaming profiles, dating platforms — if the username appears, Maigret surfaces it. The tool’s GitHub repository has accumulated over 34,700 stars, a figure that signals serious, sustained adoption well beyond a niche security research crowd.

Underneath Maigret sits Socid-extractor, the extraction engine that does the heavy data parsing. Feed it any profile URL and it returns structured identity data drawn from more than 150 platforms — names, linked accounts, identifiers, timestamps. Where Maigret casts the net wide, Socid-extractor processes what comes back, converting scattered digital breadcrumbs into organised, queryable intelligence. Together the two tools form a username lookup pipeline capable of producing the kind of person profile that would previously have required either specialist software or significant manual research hours.

Both tools are written in Python and published openly on GitHub at no cost. There is no licence fee, no institutional subscription, no approval process. Anyone who can run a Python script can deploy the same open-source intelligence gathering capability used by professional investigators and security researchers. The developer behind both projects, known on GitHub as soxoj, reported 100,000 downloads in a single month — a download volume that makes clear these tools have crossed from the security community into a significantly broader user base.

The practical reach of this kind of username search tool extends across digital footprint analysis, identity verification, and personal data aggregation in ways that most people have never considered. A username chosen years ago for a gaming forum may be the same handle used on a fitness tracker, a professional directory, and a regional classifieds site. Maigret finds all of it. The connections it draws between accounts constitute a form of passive surveillance that requires no cooperation from the platforms involved and no awareness from the person being searched.

The Numbers That Signal a Tipping Point

Maigret sits at 34,707 GitHub stars. That number matters because GitHub stars function as a reliable proxy for developer trust — engineers star repositories they use, recommend, or intend to deploy. At that count, Maigret ranks among the most-starred open-source OSINT projects on the platform, placing it in the same conversation as tools backed by funded security teams rather than a single developer working in public.

The download figures push the story further. Soxoj, the developer behind Maigret, cites 100,000 downloads in a single month across Maigret and its companion extraction engine, Socid-extractor. One hundred thousand downloads is not a niche security researcher metric. That volume suggests the tool has moved beyond penetration testers and digital forensics specialists into a broader population — journalists, private investigators, HR professionals, and people with no formal background in username enumeration or social media intelligence who simply want to find out what a person’s online footprint looks like.

The infrastructure behind these numbers signals staying power. Soxoj maintains seven Python packages on PyPI alongside more than 30 tools and over 10 guides and curated lists. This is a structured, professionalised operation. Developers who maintain active PyPI packages accept ongoing obligations: version compatibility, dependency management, security patches, user-facing documentation. The sustained investment makes Maigret’s continued improvement far more likely than a tool abandoned after its initial release spike.

Taken together, these figures mark a tipping point. Open-source person-search tools and username-lookup utilities capable of querying more than 3,000 sites no longer require specialist knowledge to access or run. The barrier between professional OSINT capability and casual use has collapsed, and the download trajectory shows it happening fast. Digital privacy assumptions built on the idea that aggregating someone’s online identity requires skill, time, or money no longer hold. The skill requirement has been engineered away. The time requirement is measured in seconds. The money requirement is zero.

The Missing Context Most Coverage Ignores: Who Is Actually Using This?

The only public window into Maigret’s reach comes from its creator’s GitHub Sponsors fundraising page, where soxoj reports 100,000 downloads in a single month. That framing serves a specific purpose: attracting financial backers to an open-source project. It says nothing about who those 100,000 downloaders actually are or what they did with the tool afterward.

That distinction matters enormously. Username-enumeration software that queries 3,000+ platforms and automatically builds a cross-site profile dossier does not attract a uniform user base. Journalists use tools like Maigret to verify sources and expose bad actors. Cybersecurity researchers use them for attack surface mapping and red team exercises. Private investigators run username lookups as standard background-check procedure. Hiring managers and HR teams increasingly deploy digital identity tracing to screen candidates. None of that is secret, and much of it sits in legal gray zones depending on jurisdiction.

But those same capabilities draw stalkers conducting targeted harassment campaigns, obsessive ex-partners tracking someone who deliberately went quiet online, and state-level actors building profiles on dissidents, activists, and journalists. A tool with 34,700 GitHub stars and five-figure monthly downloads has almost certainly landed in all of those hands. The download counter treats every use case as equivalent.

Most tech media coverage of open-source OSINT tools defaults to the capability frame: here is what the software finds, here is how fast it runs, here is the breadth of its site coverage. The consequence frame — what aggregated profiling does to ordinary people who never consented to having their scattered digital footprints stitched into a single dossier — rarely appears in the same article. That omission is not neutral. It normalizes the infrastructure of mass surveillance while deferring the harder privacy questions to regulators, courts, and eventually the people harmed.

The 100,000 download figure is a growth metric. Treated as the whole story, it obscures the real question: at what point does a freely distributed person-tracking tool become a public safety issue rather than just a developer achievement?

Why ‘Public Data’ Is No Longer a Safe Excuse

The “it’s public data” defence has a logical limit, and Maigret exposes it. Any single profile a user posts on Reddit, Spotify, or a niche gaming forum is public by choice. But Maigret doesn’t stop at one profile. It queries over 3,000 sites simultaneously, stitching together every username match into a unified dossier — a behavioural map that reveals platform habits, interest clusters, geographic patterns, and social connections. No individual platform agreed to enable that kind of cross-site identity correlation. The user certainly never consented to it. Yet it happens in seconds, automatically, on anyone’s laptop.

Socid-extractor sharpens the problem further. Feed it any profile URL and it returns a structured OSINT record — formatted, machine-readable, ready to feed into downstream analysis. What once demanded hours of manual open-source intelligence gathering now runs as a Python script. The barrier to correlating digital identities across 150-plus sites has effectively collapsed. This is the aggregation problem in its most practical form: individually harmless data points combined at scale produce something qualitatively dangerous.

Privacy law has not caught up. GDPR and its equivalents were built around a corporate threat model — they regulate how companies store, process, and transfer personal data. They impose consent requirements, data minimisation obligations, and breach notification duties on organisations. They say almost nothing about a private individual running an open-source reconnaissance script on their own machine, against publicly accessible pages, storing the output locally. That activity sits in a regulatory blind spot.

The downstream consequences are real. Stalkers, abusive ex-partners, doxxers, and corporate espionage actors all benefit from the same toolchain that security researchers use legitimately. Automated username-to-identity mapping tools like Maigret democratise digital surveillance in ways that no single-platform privacy setting can counter. Locking down one account leaves 2,999 others as potential data sources. The assumption that separating your online identities across platforms provides meaningful privacy protection no longer holds — not against automated OSINT aggregation at this scale.

The Open-Source Paradox: Transparency as Both Safeguard and Risk

Open-source code does something commercial surveillance software rarely does: it shows its work. Anyone can pull up Maigret’s repository on GitHub, read exactly which 3,000-plus sites it queries, trace the logic it uses to match usernames, and identify where it produces false positives. That auditability gives researchers, journalists, and privacy advocates a lever they simply don’t have with opaque people-search platforms that charge subscription fees and disclose nothing about their data sourcing. When Maigret gets something wrong, the community can see why and push a fix. That feedback loop is a genuine structural advantage.

The same openness eliminates every guardrail.

Once a user downloads Maigret, the developer Soxoj has zero visibility into how it runs. No telemetry, no license enforcement, no terms-of-service mechanism with any teeth. The tool can be forked, modified, rebranded, and deployed against targets its creator never intended — stalking victims, journalists in authoritarian states, activists whose digital footprint spans dozens of platforms. The username-profiling capabilities that make Maigret valuable for legitimate digital investigations make it equally powerful as a harassment instrument. Nothing in the open-source model interrupts that use case.

The funding structure compounds the tension. Soxoj’s GitHub Sponsors page markets Maigret’s reach as a selling point — 100,000 downloads in a single month, 34,700-plus GitHub stars — to attract financial backers. Sponsors pay for continued development and wider distribution. That incentive structure rewards growth, not restraint. A developer who slowed adoption to assess safety implications would be working directly against the signals the platform uses to justify support. Responsible stewardship of a tool this capable arguably requires asking hard questions about access; the sponsorship model structurally discourages asking them.

This is the core paradox of open-source OSINT: transparency about methods does not translate into transparency about use. Maigret’s codebase is readable. Its deployment is invisible. Privacy advocates who celebrate open-source alternatives to commercial data brokers need to reckon with the fact that “auditable” and “accountable” are not synonyms.

What Needs to Happen Next: Norms, Not Just Features

The OSINT community has long operated on informal ethical codes — shared norms passed through forums, Discord servers, and GitHub readme files that most casual users never read. Maigret pulling 100,000 downloads in a single month changes that calculus entirely. At that scale, the tool’s user base has expanded far beyond trained investigators into a general population with no shared professional ethics, no accountability structures, and no clear understanding of where legal username lookup ends and illegal stalking or harassment begins. The fix isn’t another paragraph buried in documentation. It’s friction built directly into the tool — explicit prompts, use-case warnings, and bright-line guidance on lawful versus harmful profiling baked into the interface itself.

Policymakers focused on AI regulation are debating hypothetical future risks while present-tense automated profiling tools operate in plain sight. Maigret searches over 3,000 platforms from a single username input and generates structured dossiers on real people, right now, outside any existing legal framework that meaningfully governs its use. GDPR addresses data controllers and processors, not open-source username aggregation tools run locally on personal laptops. The gap is real and specific, and tools like Maigret — alongside its extraction engine socid-extractor, which structures profile data across 150-plus sites — are the concrete examples regulators need to move from abstraction to actual rulemaking on automated personal data aggregation.

For individuals, the immediate practical reality is this: using different usernames across platforms is no longer a viable privacy strategy. Cross-platform username correlation, once a slow manual process requiring specialized skill, now runs automatically in minutes. The assumption that compartmentalization across Reddit, Twitter, and niche hobby forums creates meaningful anonymity is functionally obsolete. Digital hygiene needs a full reset — one that accounts for metadata consistency, profile image reuse, writing style fingerprinting, and the compounding effect of data points that appear harmless in isolation. The tools aggregating that data are already widely distributed. The norms and regulations governing their use are not.