Amamiya

OSINT username checker across 480+ platforms

Fast, async username checker powered by the Sherlock Project database, with mutation generation, avatar matching, retry logic, and optional proxy support built on top.

Output is filtered by default — only found results (plus anything needing manual review) are shown, cutting through the noise of hundreds of "not found" lines. Full output is one flag away.

Features

• 480+ platforms checked in parallel (async, aiohttp)
• Smart detection — uses the correct verification method per site (HTTP status code, error message match, or redirect check), not a one-size-fits-all guess
• Soft-404 detection — catches sites that return HTTP 200 for a nonexistent profile but actually show a "not found" page (multi-language: English, Russian, Spanish, German, French, Portuguese) or redirect to the homepage
• Filtered output by default — only shows found results and anything needing manual review; -v / --verbose shows everything
• 403 handling — requests blocked by bot protection (Cloudflare, WAFs, etc.) are flagged as "check manually" instead of being guessed at
• Mutation mode — checks common variations of a username (leetspeak, separators, affixes), not just the exact match
• Fuse optimization — skips remaining mutation variants for a site once it's clear that site itself is unreachable, instead of retrying every variant against a dead site
• Avatar matching — compares profile pictures across found platforms via perceptual hashing to flag likely same-person matches, with a default-avatar filter so placeholder icons don't produce false matches
• Automatic retries — transient network failures get retried before being marked as an error
• Optional proxy support — route requests through an HTTP/SOCKS5 proxy to reach region-blocked sites
• JSON reports — every run saves a structured report with timestamps and full results
• Username format validation — skips platforms where the username can't possibly be valid, saving requests
• --self-test — validates the checker itself against each site's own known-good account, independent of any real search target
• --safe-mode — skips known NSFW/adult platforms entirely
• Unicode normalization — usernames are NFKC-normalized before checking, closing a minor homoglyph-confusion angle

Example output

[+] Checking: example_user
[+] Total sites: 478 (skipped 2 variants due to invalid format) — showing found only, use -v for full output

  [✓] GitHub               [200]     https://github.com/example_user
  [✓] Reddit                [200]     https://www.reddit.com/user/example_user/
  [⚠] SomeGatedSite         [403]     https://example.com/example_user (403 — check manually)

============================================================
  Found:              224
  Not found:          188
  Possibly found:     0
  Check manually:     3 (403 — blocked by bot protection)
  Error/Timeout:      16
============================================================

[+] Results saved in amamiya_example_user_20260821_140000.json

Installation

git clone https://github.com/duki-core/amamiya.git
cd amamiya
python -m venv .venv
source .venv/bin/activate  # Windows: .venv\Scripts\activate
pip install -r requirements.txt

Usage

Basic search (found results only, by default):

python amamiya.py <username>

Show everything, including not-found and errors:

python amamiya.py <username> -v

Save report to a specific file:

python amamiya.py <username> -o report.json

Use a proxy (useful for platforms blocked in your region):

python amamiya.py <username> -p http://ip:port
python amamiya.py <username> -p http://user:pass@ip:port

Full options:

python amamiya.py --help

Running with Docker

For a guaranteed, dependency-free run on any machine (a professor's laptop, a grading server, etc.) — no need to install Python or any packages locally:

docker build -t amamiya .
docker run --rm amamiya <username>

To get the JSON report out onto your host machine, mount a volume:

docker run --rm -v $(pwd)/output:/app/output amamiya <username> -o output/report.json

data.json must be present in the project directory before building the image — it's copied in as part of the build.

Mutation mode

Instead of checking only the exact username, mutation mode also checks common variations people use when their preferred nickname is already taken elsewhere.

python amamiya.py <username> -m                    # default: leetspeak + separators
python amamiya.py <username> -m --leet              # leetspeak only (a→4, o→0, s→$, etc.)
python amamiya.py <username> -m --separators        # separator/case variants (nick_, _nick, nick-, CamelCase, etc.)
python amamiya.py <username> -m --affixes           # common prefixes/suffixes (_official, _pro, _2024, etc.)
python amamiya.py <username> --all                  # everything combined — will prompt for confirmation (much slower)
python amamiya.py <username> --all -y               # same as above, skip the confirmation prompt

Mutation mode uses a fuse: if the exact username fails on a given site (timeout, connection error), the remaining variants are skipped for that specific site instead of being checked individually — a failure like that almost always means the site itself is unreachable, not that the username format is the issue.

Avatar matching

python amamiya.py <username> --avatars              # compare avatars across all found profiles
python amamiya.py <username> -m --avatars           # mutation mode + avatar matching

Avatar matching looks for near-identical images (the same photo, possibly re-compressed or resized) — not visually similar but different photos of the same person, which would require face recognition, a heavier and more legally sensitive technique this project deliberately avoids.

Two modes, depending on whether mutation mode is active:

• Plain mode (no -m): compares all found profiles against each other, pairwise.
• Mutation mode (-m --avatars): uses the first valid avatar from an exact-nickname match as a reference, then checks only whether each mutation's avatar matches that reference — not mutations against each other. This keeps the signal clean: a match is only reported when there's solid evidence (a confirmed exact-match profile with a real photo) to compare against.

Known default/placeholder avatars (Discord's default icon, Twitter's egg, etc.) are filtered out via default_avatars.json before comparison, so two inactive profiles don't get wrongly "matched" just because they share the same blank icon. See hash_default_avatar.py for a helper script to extend this database with more platforms.

Self-test and safe mode

Validate the checker itself, independent of any real target — for every site that has a known-good account (username_claimed in data.json), checks that account and reports how many sites correctly detect it as found. Doesn't need a nickname:

python amamiya.py --self-test

This is useful after refreshing data.json from Sherlock, or after making changes to checker.py — it catches detection bugs (wrong verification logic, a site's page structure having changed) that have nothing to do with any specific person being searched for.

Skip known NSFW/adult platforms entirely:

python amamiya.py <username> --safe-mode
python amamiya.py --self-test --safe-mode

The NSFW list lives in nsfw_sites.py — it's a best-effort, community-extendable set, not an exhaustive audit of every platform in data.json.

How it works

1. sites_loader.py loads the platform database from data.json (Sherlock's format) and normalizes it into a consistent internal structure.
2. checker.py checks each platform using the method Sherlock has already determined is reliable for that specific site:
   • status_code — 200 means found, anything else means not found (with multi-language soft-404 detection layered on top)
   • message — looks for a known "not found" string in the page content
   • response_url — compares the final URL after redirects against a known "not found" pattern
   • A 403 response short-circuits all of the above and is flagged as "check manually" — bot protection makes the result unreliable either way
3. mutations.py generates username variants (leetspeak, separators, affixes) for mutation mode.
4. avatars.py extracts avatar URLs from found profiles (via Open Graph / Twitter Card meta tags), hashes them, and compares them to flag likely same-person matches.
5. amamiya.py orchestrates everything: builds the request pool, handles concurrency limits, filters/prints live results, and writes the final JSON report.

Notes

• Some platforms may be blocked or throttled in certain regions (e.g. due to national-level restrictions) — this shows up as connection errors or timeouts and is expected. Use --proxy to work around this.
• The site database (data.json) is a snapshot from Sherlock at the time of download. Platforms occasionally change their structure, which can cause detection accuracy to drift over time. You can refresh it from the Sherlock repository.
• This tool only checks publicly accessible information (whether a username exists on a platform, and whether its avatar matches another public avatar). It does not access private data, bypass authentication, or perform face recognition.

Credits

Platform database originally from the Sherlock Project (MIT License).

License

MIT

---

See CHANGELOG.md for release history and SECURITY.md for security-related fixes.