People ask me who is behind a username more than any other question, and the honest answer is that a handle alone does not tell you. A username is a string, not a person. What a reverse username lookup gives you is a list of live public accounts that use that string, plus the fields around each one: display names, bios, avatars, join dates and outbound links. Whether those accounts belong to one person or to five different people is something you work out from the fields, and this post shows the method on two real exports pulled on 2026-09-05.
The first export is for davidbombal, a public figure whose handle is consistent everywhere. The second is for srhoe, a short handle that several unrelated people have registered on different services. Same tool, same 770 endpoints, and two very different answers. If you want the mechanics of how a scanner decides that an account exists at all, read what a username search tool actually checks first; this post starts where that one ends.
Who is behind a username: the three questions to answer
Every reverse username lookup I run comes down to the same three questions, in order. Does the handle exist on platforms where accounts are hard to fake or expensive to abandon? Do the profiles agree with each other on name, picture, bio and links? And do the profiles point outward at each other, or at a website, in a way that a stranger could not easily counterfeit?
A scanner answers the first question. A person answers the other two, and the export is built to make that fast. I run the sweep at osintsearch.org, download the JSON, and read the identity block before I read any single profile. The identity block is a summary the engine computes across every hit: the most common display name and how many platforms agree on it, the most common location, every spelling variant of the handle, websites that appear in more than one bio, and a list of profile links. It is a starting hypothesis, not a verdict.
Step 1: run the sweep and count what came back
For davidbombal the scan covered all 770 username endpoints in 29 seconds and returned 59 live profiles. For srhoe it returned 31 in 28 seconds. Both exports list every endpoint by name with its outcome.
The found count on its own means little. A public figure lights up 50 or 60 services, and a common five-letter word does the same because many people picked it. What separates the two cases is how much each hit carries.
Step 2: read the fields, not the links
I counted how many of the 59 davidbombal hits carry each field. Display names are present on 47, a profile picture on 41, a numeric user id on 41, a join date on 26, a bio on 23, a follower count on 15, a location on 15, outbound links on 12, and a last-active timestamp on 4. Those numbers come straight from the JSON.
The order matters. Display names and pictures can be compared by eye across dozens of hits in a minute. Join dates tell you which account came first, which is how you spot a handle picked up by a second person after the original owner moved on. Bios and outbound links are rarer but carry the most weight: a bio is a claim the holder wrote, and a link is a claim another page can confirm.
On the free plan you see every one of these hits with every value printed: the bio, the id, the joined date, the links. The Starter and Pro plans add the export, breach records and deep search. The differences are laid out field by field in free vs Pro results on the same 31 hits, which happens to use the srhoe scan.
Step 3: check whether the profiles agree
This is where the two exports split. In the davidbombal identity block the probable name is drawn from 18 agreeing platforms: Mix, Odysee, Behance, GitHub, Threads, Twitter, Calendly, Cash App, Tap Bio, SoundCloud, Amazon, Flipboard, Instagram, Picsart, Clubhouse, YouTube, Blogspot and CodersRank. The alternatives are all decorated forms of the same name, such as a store name on Creator Spring and a "Presentations by" prefix on Slides. The engine scores the name at 0.31, and the score is deliberately conservative: it is agreement divided by every hit in the set, including bare registrations on gaming and developer sites that carry no name to agree with. Eighteen named sources behind one value is a strong result.
The location block shows how not to overread a number. Three platforms mention the United Kingdom and the score is 0.05: a hint worth checking, not a finding, and the score says so.
The srhoe block looks different in kind. The probable name rests on four sources, two payment apps, GitHub and Instagram, at 0.13. The alternatives are not decorated versions of that name. Strava shows a different two-word name, Behance shows a third, and Twitter shows a display name that is just a word. Payment apps, a code host and a photo app agreeing with each other is a real cluster, and I would treat that cluster as one person. Strava and Behance sit outside it and belong to someone else. The 31 hits are not one dossier; they are one dossier plus a handful of unrelated registrations that happen to share five letters.
Step 4: follow the outbound links both ways
Links are the strongest signal in a username export because they are hard to fake at scale. In the davidbombal set, the GitHub profile links to a Twitter account and lists a YouTube channel as its website. The YouTube channel links back to a personal domain, Twitter, LinkedIn and Instagram. SoundCloud links to YouTube, Twitter and Instagram. Threads links to a Tap Bio page, and Tap Bio and Twitter both name the same personal domain. That is a closed loop across six platforms, and a closed loop is what "one person" looks like in data.
The same export also shows what a loop is not. The Codecanyon hit carries four outbound links, all labeled, and all of them go to the marketplace's own corporate accounts, because that platform prints its brand links on every profile page. The Truth Social hit has a different display name and a different website entirely and shares nothing with the loop. And the ENS hit gives a second handle variant, davidbombal.eth, which the identity block lists separately because a wallet name is not proof of the same owner until something links it.
For srhoe, the links are what define the cluster. GitHub, Kick and a link-in-bio page all point to the same Twitter handle spelled with a digit, and to Twitch and TikTok handles that are also digit variants. Behance points to a completely different Instagram account. I ran a depth-3 deep search on those four discovered handles, which cost 6 units, and it swept all four and confirmed the cluster is closed: no further accounts hang off the variants. A closed cluster is a finding in its own right: the export already holds everything the links can reach. When deep search earns its cost is covered in deep search on social media.
{
"probable_name": { "confidence": 0.31, "sources": 18 },
"probable_location": { "value": "United Kingdom", "confidence": 0.05 },
"username_variants": ["davidbombal", "davidbombal.eth"],
"websites": ["https://www.davidbombal.com", "https://tap.bio/@davidbombal"]
}Step 5: decide what you can actually say
After the four steps above, the honest statement for the first export is: one person operates a cluster of at least 18 accounts that agree on a name, six of which link to each other, and a few hits in the set belong to someone else. The honest statement for the second is: a handful of accounts form one cluster, several others are unrelated, and the handle should not be treated as an identifier for anyone without more evidence.
Notice what is not in either statement: no legal name confirmed, no home address, no employer, no phone number. A username lookup reaches public profile pages, which is exactly the boundary a public lookup should have. If your next pivot is a number, the evidence is a different shape again, and I wrote it up in who is behind a phone number and the longer phone number OSINT guide.
FAQ
Can a reverse username lookup give me a real name?
It gives you the display names account holders chose and how many platforms agree on one. On the first export 18 platforms agreed; on the second, four did and three disagreed. That is evidence about a name, not confirmation of one.
Why is the confidence score 0.31 when 18 platforms agree?
Because the score is measured against every hit, including bare registrations with no bio, name or picture, which cannot agree with anything. A 0.31 with 18 named sources is strong; a 0.13 with four is weak, and the gap is the point.
How do I tell if a handle belongs to several people?
Compare display names, faces and join dates and look for clusters, then follow the outbound links. Accounts that link to each other are one cluster; accounts that link elsewhere or show a different name and face are a second person.
Does the free plan show the fields I need for this?
The free plan runs the full 770-endpoint sweep and shows every field on every hit, so you can read the bios, ids and links on screen. Downloading the export needs the Starter plan at $20 a month; deep search needs Pro. Current quotas are on the pricing page.
Where to go from here
Run the sweep, read the identity block, sort into clusters, follow the links, then write down only what the evidence supports. If the handle has changed over the years, finding old usernames is often the step that connects two clusters that looked unrelated.
