# What Kind of User Information Can User-Scanner Scan For: Complete OSINT Data Guide

> Discover what user information User-scanner can find. This OSINT tool extracts account status, profile metadata, media, and URLs from 460+ platforms.

- Repository: [Kaif/user-scanner](https://github.com/kaifcodec/user-scanner)
- Tags: deep-dive
- Published: 2026-08-30

---

**User-scanner is a Python-based OSINT suite that extracts account existence status, public profile metadata (bios, follower counts, karma), media assets (avatars, banners), and canonical profile URLs from over 460 platforms using both username and email-based searches.**

User-scanner by kaifcodec is an open-source intelligence (OSINT) framework designed to interrogate digital identities across hundreds of online services. Whether you are investigating a username or verifying an email address, understanding what kind of user information user-scanner can scan for is essential for effective reconnaissance. The tool aggregates data into structured `Result` objects that expose registration status, rich metadata, and media assets through a unified Python API.

## The Core Result Object Structure

Every scan operation returns a **`Result`** instance defined in [`user_scanner/core/result.py`](https://github.com/kaifcodec/user-scanner/blob/main/user_scanner/core/result.py). This object standardizes the data schema across all 460+ supported platforms, ensuring consistent access to five primary data fields.

### Account Status and Availability

The **`status`** field indicates whether a target is **taken** (`Found`/`Registered`), **available** (`Not Found`/`Not Registered`), or resulted in an **error**/**skipped** state. According to the `Result.Status` class implementation, this classification allows automated pipelines to filter for active accounts versus available handles for registration.

### Profile Metadata (The `extra` Dictionary)

The **`extra`** field contains a free-form dictionary of **metadata** extracted by each platform module. As implemented in `Result.update()` (lines 106-119), this dictionary captures platform-specific fields such as:

- **Display names** – `extra["name"]` stores real names or handles (e.g., Reddit, Instagram)
- **Biographical data** – `extra["bio"]` holds profile descriptions
- **Engagement metrics** – `extra["followers"]`, `extra["subscriber_count"]`, and `extra["karma_total"]` quantify account reach
- **Account provenance** – `extra["created"]` timestamps registration dates
- **Verification states** – `extra["verified"]` and `extra["has_verified_email"]` indicate platform verification
- **Custom status flags** – `extra["status"]` reports Reddit-specific states like "deleted" or "suspended"

### Media Assets (The `media` Dictionary)

The **`media`** dictionary stores URLs to publicly accessible visual assets. Populated by each module’s `_extract_media` routine (see [`user_scanner/user_scan/social/reddit.py`](https://github.com/kaifcodec/user-scanner/blob/main/user_scanner/user_scan/social/reddit.py) for reference), this field typically includes:

- **Avatar URLs** – `media["avatar"]` links to profile pictures
- **Banner images** – `media["banner"]` stores cover photos
- **Platform-specific assets** – Such as Reddit’s `snoovatar` custom avatars

### Canonical Profile URLs

The **`url`** field provides the direct link to the public profile page that was queried. This enables immediate browser pivoting or archival without requiring manual URL construction.

## Types of User Information Extracted

User-scanner differentiates between username-based and email-based investigations, with each module populating the `Result` object according to the data exposed by the target platform.

### Existence and Registration Verification

For **username modules** (e.g., [`user_scanner/user_scan/social/reddit.py`](https://github.com/kaifcodec/user-scanner/blob/main/user_scanner/user_scan/social/reddit.py), [`github.py`](https://github.com/kaifcodec/user-scanner/blob/main/github.py)), the tool reports whether a handle is **taken** or **available**. For **email modules** (e.g., [`user_scanner/email_scan/social/instagram.py`](https://github.com/kaifcodec/user-scanner/blob/main/user_scanner/email_scan/social/instagram.py), [`gmail.py`](https://github.com/kaifcodec/user-scanner/blob/main/gmail.py)), it determines if an address is **registered** or **not registered** on the platform.

### Deep Profile Metadata Extraction

Each platform-specific scanner extracts whatever public fields the site exposes through the `_extract_profile` helper methods. The Reddit module, for instance, surfaces `employee` status and total karma, while Instagram modules expose `private` account flags and follower counts. This metadata mining occurs after the initial existence check, providing intelligence beyond simple boolean availability.

### Cross-Scan Pivot Data

When invoked with the **`--cross-scan`** flag, the engine mines **links, secondary usernames, and secondary email addresses** from the initial results. This pivot data is recursively scanned and surfaced via `extra["links"]`, enabling network mapping of connected digital identities.

## Architecture and Data Flow

Understanding the pipeline clarifies how user-scanner aggregates this information.

### Engine Orchestration

The **`engine.check()`** function in [`user_scanner/core/engine.py`](https://github.com/kaifcodec/user-scanner/blob/main/user_scanner/core/engine.py) determines whether the target is a username or email and loads the appropriate module set (`user_scan` versus `email_scan`). This high-level orchestration manages the asynchronous execution of platform modules.

### Module Validation and Extraction

Each module implements a **`validate_<site>`** function (e.g., `validate_reddit`) that performs HTTP requests—often utilizing the impersonation helpers in [`user_scanner/core/impersonate.py`](https://github.com/kaifcodec/user-scanner/blob/main/user_scanner/core/impersonate.py) to bypass bot detection. Based on the response, the module returns a `Result` instance via `Result.taken`, `Result.available`, or `Result.error` factory methods.

## Practical Implementation Examples

### Scanning a Single Username

```python
import asyncio
from user_scanner.core import engine
from user_scanner.user_scan.social.reddit import validate_reddit

async def main():
    result = await engine.check(validate_reddit, "spez")
    print(result.to_json())
    result.show()

asyncio.run(main())

```

This returns a JSON structure containing the status, karma totals, creation dates, and avatar URLs as defined in the `Result` class.

### Scanning a Single Email Address

```python
import asyncio
from user_scanner.core import engine
from user_scanner.email_scan.social import instagram

async def main():
    result = await engine.check(instagram, "example@gmail.com")
    print(result.to_json())

asyncio.run(main())

```

Email scans populate the same `Result` schema, with the `extra` dictionary containing mapped usernames and privacy flags specific to the platform.

### Bulk Scanning and Export

```python
import asyncio
from user_scanner.core import engine
from user_scanner.core.formatter import into_json

async def main():
    usernames = ["alice", "bob", "charlie"]
    results = await engine.check_all(usernames, is_email=False)
    with open("report.json", "w") as out:
        out.write(into_json(results))

asyncio.run(main())

```

The `engine.check_all()` method aggregates multiple `Result` objects into JSON, CSV, or PDF formats via the formatter utilities.

## Summary

- **User-scanner** extracts **existence status**, **metadata** (bios, karma, followers), **media URLs** (avatars, banners), and **profile links** from over 460 platforms.
- Data is standardized in the **`Result`** class ([`user_scanner/core/result.py`](https://github.com/kaifcodec/user-scanner/blob/main/user_scanner/core/result.py)), providing consistent fields: `status`, `url`, `extra`, `media`, and `reason`.
- Both **usernames** and **email addresses** are supported through modular scanners in `user_scanner/user_scan/` and `user_scanner/email_scan/`.
- **Cross-scan capabilities** enable recursive investigation of linked accounts found in initial searches.
- Output formats include **JSON**, **CSV**, and **PDF** via the formatter module for integration into automated pipelines.

## Frequently Asked Questions

### What types of targets can user-scanner investigate?

User-scanner supports both **username-based** and **email-based** investigations across social networks, code repositories, gaming platforms, and communication services. The engine automatically routes targets to the appropriate validation modules in `user_scanner/user_scan/` or `user_scanner/email_scan/` based on input format detection.

### How does user-scanner handle bot detection and rate limiting?

The tool implements **impersonation techniques** in [`user_scanner/core/impersonate.py`](https://github.com/kaifcodec/user-scanner/blob/main/user_scanner/core/impersonate.py), utilizing `curl-cffi` sessions to mimic legitimate browser fingerprints. This allows modules like `validate_reddit` to bypass basic bot walls and access public profile data that would otherwise be blocked to automated requests.

### Can user-scanner extract private account information?

No. User-scanner only accesses **publicly available** data exposed by platform APIs or HTML responses. Fields like `extra["private"]` indicate privacy settings but do not grant access to protected content. The tool respects platform visibility settings, reporting only what is openly accessible without authentication.

### What output formats does user-scanner support?

The **`Result`** object provides native serialization via `to_json()` for programmatic use, while the formatter utilities in [`user_scanner/core/formatter.py`](https://github.com/kaifcodec/user-scanner/blob/main/user_scanner/core/formatter.py) enable export to **JSON arrays**, **CSV spreadsheets**, and **PDF reports**. This multi-format support facilitates integration into data science workflows, incident response platforms, and documentation pipelines.