Aliens_eye: an AI-assisted username scanner for 840+ platforms

The gap Aliens_eye targets: status codes are not proof of an account

Most username scanners work the same way. They request a profile URL, look at the HTTP status, and print a hit when the response is not a 404. That produces two failure classes. Sites that return 200 for a missing profile generate false positives, and sites that return 404 behind a soft error page generate false negatives. The README states the project's answer directly: a trained model blended with 30 structural signals, described as HTTP status, DOM shape, keywords and fingerprints, "instead of naive status-code checks".

The intended user is someone doing information gathering on a handle rather than a real name. The repository topics list osint, information-gathering, social-media, termux and hackingtools, so the audience spans security researchers, red teams and hobbyists running this on a phone through Termux. The output is not a single yes or no. A scan produces per-platform results, extracted profile fields, and optionally clusters of accounts that look like the same person.

How detection, correlation and recursion actually fit together

The scan pipeline is asynchronous. Requests go out concurrently across the site list, and each response is scored by two paths: the heuristic signals and the ML model. `--no-ml` disables the model and leaves heuristics only, which is the honest way to see what the structural signals alone contribute. Profile extraction then pulls display name, bio and avatar from hits, using OpenGraph, JSON-LD or per-site CSS selectors depending on what the page offers.

Correlation is a second pass over those extracted fields. With `--correlate` the tool clusters profiles by avatar hash, bio text, shared links and name. Avatar-image matching needs Pillow, which is the `correlate` extra, so the clustering degrades if you skip it. Recursion is a third pass: `--recurse-depth N` follows usernames linked out of found bios and re-scans them. Each level multiplies request volume, and the README gives no guidance on rate limiting for deep recursion.

Site definitions are data, not code. The README describes drop-in `sites.d/` plugin site maps, and the usage section shows a JSON shape starting with a site name keyed to a URL. That means you can add a platform without touching the Python. The same design makes bad site rules easy to add, which is why the evaluation commands matter.

Installing Aliens_eye and running a first scan

The package is on PyPI as aliens-eye and requires Python 3.10 or newer, per pyproject.toml. The base install pulls aiohttp, Brotli, selectolax, rich, aiohttp-socks and platformdirs. Brotli is listed as required rather than optional, with a comment in pyproject.toml explaining that the default headers advertise br and aiohttp raises on the body without a decoder. That is a real constraint, not a packaging accident.

pip install aliens-eye

After install, the console entry point is `aliens_eye`. Running it with no arguments drops into interactive prompts; passing a username runs a scan directly.

# Single username, default scan level
aliens_eye username

# Only specific sites, skipping NSFW ones
aliens_eye username --site github,reddit,gitlab --no-nsfw

# Export every report format into ./results
aliens_eye username --format all --output results

The first scan prints live progress and a sorted result table through rich. If you are wiring this into a script or CI, add `--plain`, which the README describes as plain output with no colors or progress. For a containerised run, the Dockerfile builds on python:3.12-slim, copies `src`, installs the package and sets the entry point, so the image takes a username as its argument.

docker build -t aliens-eye .
docker run --rm -it aliens-eye username

Optional extras are separate installs: `aliens-eye[browser]` for the Playwright fallback (followed by `python -m playwright install chromium`), `[correlate]` for Pillow, `[pdf]` for reportlab, `[tui]` for textual, `[serve]` for the MCP server, and `[train]` for scikit-learn and numpy if you intend to retrain the model.

The evaluation harness is the differentiator, and also the warning

Aliens_eye ships commands that most scanners in this space do not have. `aliens_eye selfcheck` reports precision, recall, F1 and false-positive rate per site. `aliens_eye corpus record` freezes a response corpus so that later `selfcheck --corpus` runs replay identical inputs and produce comparable metrics. `aliens_eye eval ablate` scores detector configurations with bootstrap confidence intervals, and `aliens_eye eval external` compares against Sherlock, Maigret and WhatsMyName rules on the same stored responses.

Read that as an admission. A per-site precision number implies per-site error, and the tool is telling you the blended detector is not uniformly reliable across 840 platforms. The external comparison is the most interesting command in the list, because it puts the ML claim next to rule-based competitors on shared data. Note the constraint the README states: for `eval external` and `eval groundtruth` you fetch the Sherlock and WhatsMyName data files yourself. Nothing is bundled.

There is a practical cost here too. Recording a corpus means issuing real requests against real sites at whatever volume your split and negative count imply. The README shows `--negatives 4` for a corpus record and `--negatives 2` for a plain selfcheck, but does not discuss request budgets, throttling or terms of service for any target site.

Where Aliens_eye is the wrong tool

This is a username scanner. It takes a handle and asks which platforms have it. It does not take an email address, a phone number or a real name, and nothing in the README suggests it does. If your starting point is an email, this is the wrong entry point.

The ML path is also not free. The base install does not include scikit-learn or numpy; those arrive with the `train` extra. If you install the base package and expect the model to be doing the work, check whether the model ships as data in the wheel or whether `--no-ml` is effectively what you are running. The README does not state which, and that is a gap worth resolving before you trust a scan.

Recursion and watch mode both multiply traffic. `--watch 6h --notify <url>` re-scans on an interval and POSTs changes to a webhook, which is useful for monitoring a handle and also a way to hammer sites on a schedule. `--recurse-depth 1` follows usernames out of bios and re-scans them; each additional level compounds the request count. Neither flag is documented with a rate limit or a backoff setting. On a shared IP or a Tor exit node, that combination is likely to get you blocked, and the README does not describe how the tool handles a site that starts returning errors mid-scan.

How it compares with Sherlock and Maigret

Sherlock and Maigret are the reference points, and Aliens_eye's own `eval external` command names both. The difference in approach is the detection layer. Sherlock and Maigret decide membership from per-site rules, typically status codes plus a marker string or a regex on the response body. WhatsMyName is a similar rule corpus maintained as data. Those approaches are transparent: you can read a site's rule and know exactly why it matched.

Aliens_eye keeps the rule layer but adds a trained model on top of 30 structural signals, so the final verdict for a borderline page comes from a classifier rather than a hand-written condition. The trade-off is legibility. When a rule-based tool produces a false positive you fix one line of data. When a blended detector does, you need the ablation and selfcheck machinery to find out which signal is responsible. Aliens_eye ships that machinery, which is what makes the design defensible rather than merely opaque. It also lets you run `eval external` on the same stored responses, so the comparison is not a claim in a README but a command you can execute against data you supply.

Maintenance, licence and the cost of keeping 840 site rules alive

The last push was on 2026-09-06, and v2.3.0 was released the same day, following v2.2.3 earlier that day and v2.2.2 on 2026-07-16. The repository is not archived. The release cadence in the supplied history shows two releases on a single day, which suggests active work around the 2.3.0 cut rather than a steady drip.

The maintenance burden is structural. Detection quality depends on site rules and on a model trained against recorded responses. Sites change their markup, their error pages and their anti-bot behaviour. A frozen corpus stays valid for reproducibility and goes stale as a measure of today's web. The `label` and `train` commands exist for exactly this reason: you can hand-label uncertain hits into a training set and rebuild the model. That is a workflow, not a one-time install.

Licence is MIT, per the LICENSE file and the pyproject classifier. MIT is permissive, so you can use, modify and redistribute the code, including in commercial work, provided you keep the copyright notice and licence text. The optional dependencies carry their own licences, and Playwright, reportlab and textual are separate packages with their own terms. That is a packaging fact, not legal advice; check each dependency's licence if redistribution matters to you.

Editorial conclusion

Aliens_eye fits investigators, red teams and researchers who need per-site accuracy numbers rather than a raw hit list, and who can live with Python 3.10 or newer and a dependency set that includes Brotli. If you only want a quick username check on one or two sites, the 840-platform scan and the evaluation machinery are overhead you will not use. Before adopting it, run aliens_eye selfcheck against your own targets and read the per-site precision and FPR columns, because the blended detector is only as trustworthy as the site rules under it.

Frequently asked questions

Official sources

1. arxhr007/Aliens_eye on GitHub
2. Issues
3. License: MIT
4. README
5. Releases