Blackbird: username and email OSINT across 600 platforms

One search over a borrowed list of 600 platforms

Blackbird is an OSINT tool for finding accounts by username and email across social networks. The install is a clone and a dependency install:

git clone https://github.com/p1ngul1n0/blackbird
cd blackbird

pip install -r requirements.txt

The search itself is two flags, one for a username and one for an email:

python blackbird.py --username johndoe

python blackbird.py --email [email protected]

What makes it more than a loop over a hard coded list is that the list itself is not in the repository. Blackbird is fully integrated with the WhatsMyName project, which is described as having more than 600 sites for accurate reverse username search, and the tool's own claim of covering more than 600 platforms comes from that integration. The stated benefit of the community-driven project is a low false positive rate and high quality results, since the site list is maintained by people who know which platforms still have stable profile URLs and which ones have been dead for years.

That is the right architectural decision for this kind of tool. The hard part of username enumeration is not the HTTP requests, it is the maintenance of the target list, and delegating that to a separate project means Blackbird gets fresh data without holding a stale copy.

The trade is that Blackbird inherits the quality of that dependency, and it does not add anything to it. If WhatsMyName's list has a platform with a broken matcher, Blackbird will report a false result for it.

The alternative for a researcher who only needs the site list is to use WhatsMyName directly and check the results by hand, which avoids Blackbird's concurrency layer and its extra dependencies but gives up the filtering and the export. The other option is to query a platform directly with the requests library, which is accurate for one site and pointless for six hundred.

Smart filters and exports, which is where the real value sits

The feature list in the README highlights smart filters, polished PDF and CSV exports, and fully automated analysis from a single CLI. The export path is the most concrete of these:

python blackbird.py --email  --pdf

The PDF export is what turns the tool from a screen scroll into something you can attach to a report, and the AI results are included in the PDF as well. For a research workflow where the output goes into a case file, a formatted document beats a wall of terminal text.

The requirement list gives a sense of how the tool is built. aiohttp is there for concurrent requests, with aiohappyeyeballs and aiosignal, and requests is also present. The concurrency stack is what makes a 600 site scan finish in a reasonable time, since the naive version of this is 600 sequential requests. rich provides the terminal formatting, reportlab produces the PDF, and pillow is present for image handling. python-dotenv is used to load configuration, and the repository carries a .env file at the top level alongside a Dockerfile, a data/ directory, a src/ directory and tests/.

The container image is minimal and shows the entry point clearly:

FROM python:3.12-slim

COPY . .

RUN python3 -m pip install -r requirements.txt
ENTRYPOINT ["python3","blackbird.py"]

So the whole tool is a single Python entry point that takes the flags. A container around it is mostly about having a reproducible dependency set rather than about the tool needing isolation.

The AI step sends site names and nothing else

Blackbird has an optional AI feature that analyses the sites where a username or email was found and returns a behavioural and technical profile of the user. The privacy claim is stated as a bullet, not buried: no sensitive data is shared, only site names are sent. Usage is free, with a fair daily limit.

The feature is opt-in twice over. A key has to be generated first, and then the run has to ask for it:

python blackbird.py --setup-ai

python blackbird.py --username johndoe --ai

The distinction that matters for the privacy claim is between the site names and the identifiers. If the tool only sends the list of platforms where a match was found, then the AI engine sees a pattern, an intersection of platforms, and nothing about the account itself. The behavioural and technical profile it returns is a deduction from the combination of platforms, which is a real analytical technique, since a person with a presence on specific kinds of services has specific habits.

It is also the reason to read the claim carefully rather than accept it. The identity of the account holder is inferred from the platform list, and the inference is exactly as good as the match quality of the underlying WhatsMyName data. A false match on one site changes the intersection and therefore changes the profile.

The daily limit and the requirement for your own key mean this path depends on a hosted service, which is the one part of the tool that is not local.

A third-party installer exists for Linux users

On Linux there is an alternative install route through OTinstaller, a third party installer from OSINTVerseHQ, and the README points at its own issue tracker for install problems, which is a sensible division of responsibility.

pipx install otinstaller
otinstaller init
otinstaller install blackbird
otinstaller run blackbird -- --username johndoe

The important detail is the argument separator. The README states that with OTinstaller you use otinstaller run blackbird -- <options> in place of python blackbird.py <options> in the examples. The double dash is what separates the installer's own options from the tool's, and getting it wrong produces an error from the wrong program.

The reason the tool offers a plain pip install at all is that the requirements are ordinary. There is no compiled extension, no system library to install, and the Dockerfile confirms that python:3.12-slim with pip install -r requirements.txt is enough. A third-party installer is convenient for people who already use one, and unnecessary for everyone else.

The disclaimer is the most substantive part of the README

The README closes with a disclaimer block, and it is longer and more specific than the documentation for the tool itself. It states that the program is for educational purposes only and should not be used without permission, and that the usual disclaimer applies, with the author not liable for any damages caused by direct or indirect use of the information or functionality provided. It says the author or any internet provider bears no responsibility for content or misuse of these programs or any derivatives, and that by using them you accept that any damage, including data loss, system crash or system compromise, caused by their use is not the author's responsibility.

The tone is defensive, and the language is that of a tool that has been used in ways the author did not intend. That is a fair signal about what a username and email search tool gets used for. Searching for your own handles is the obviously legitimate case, and searching for someone else's is the same operation with a different target, which is why the boundary is drawn by the operator rather than by the software.

The project also carries a project developer credit for Lucas Antoniaci and a sponsor badge for DigitalOcean referral credits, and the documentation lives on a GitBook site rather than in the repository, with the repository itself carrying a docs/ directory, an assets/ directory and a src/ directory alongside the single blackbird.py entry point. The licence is not stated, which is worth noting separately, since the repository carries no LICENSE file among its top level entries.

Editorial conclusion

Adopt Blackbird when you need one command that checks a username or email across many sites at once, since the site list comes from WhatsMyName and the tool adds a results filter, structured exports and an optional profiling step on top of it. Do not adopt it as a source of truth about an identity, because a match on a platform is a username match and not proof that the same person owns every account, and the project is explicit that the underlying list is maintained elsewhere. Before you run it, read the disclaimer, since the author states the tool is for educational purposes and disclaims responsibility for how the results are used, and note that the licence is not stated in the repository.

Frequently asked questions

Official sources

1. antoniaci/blackbird on GitHub
2. Issues
3. Project website
4. README