How it works

How Oracul works

A scan takes a username, email or phone, looks for accounts on thousands of sites, follows the links it finds recursively, drops namesakes and other people's profiles and builds a passport, a timeline and risk signals. Open sources only: no logging into anyone's accounts, no emails to the subject.

~5800sites in scanner databases

1–3recursion rounds

14identifiers per scan

45 minscan timeout

0.5face similarity threshold

30 dretention

Diagram: what a scan is built from

Eight layers, bottom to top. Each one stands on the one below. Click a layer to see what happens in it.

01queue · up to 45 min

Queue and start

POST /v1/scans or the New scan button. The scan joins the API queue.

POST /v1/scans · nick + email + name✓
plan limit reached → 429✕
API restart → scan back in queue✓

One scan, end to end

1Inputusername · email · phone + name and purpose
2Engines~5800 sites, 3 scanners + APIs
3Linksnew nicks and emails → next round
4Judgenames, faces, shared nicks, marks
5Profilepassport, graph, timeline
6Signalsflags for antifraud/KYC
7Outputconsole · PDF · HTML · API

Step by step

Start and queue

POST /v1/scans or the New scan button. The scan joins the API queue.

Seeds: usernames, emails, phones (several at once) + the subject's name, title and purpose.
The plan sets the limits: recursion depth (free 1, pro 2, business/enterprise 3), full mode, breaches, webhooks, requests per minute.
Each scan is its own engine process with a 45-minute timeout.
A scan cut by an API restart goes back to the queue. Cancel kills the engine process.
Progress is the engine's last line, shown in the console and in GET /v1/scans/{id}.

Engines: where we look

Each identifier runs through the scanners and our own enrichers.

user-scanner ~2700 сайтовmaigret ~3000 сайтовholehe ~120 сайтовGitHubGitLabKeybaseGravatarXposedOrNotphonenumbers

user-scanner: username and email on ~2700 sites, is there an account.
maigret: ~3000 sites, pulls profile data: name, city, bio, links, avatar, linked ids.
holehe: which of ~120 services an email is registered on, without triggering password recovery.
GitHub: profile, emails from commits, commit search by email. GitLab: public email. Keybase: proofs → other nicks. Gravatar: linked accounts.
XposedOrNot: breaches by email (paid plans only). phonenumbers: offline phone parsing: country, carrier, type (mobile / VoIP).
Fast mode: top sites and shorter timeouts; full mode: every scanner database.

Recursion: linked nicks and emails

Every account that is "theirs" gives new entry points, scanned in the next round.

Link sources: profile fields, bio and website links, maigret ids, Keybase proofs, Gravatar accounts, commit authors.
Links are taken only from accounts whose name matches the subject or from strong sources: other people's profiles do not grow the graph.
Name permutations (pavel.belov, pbelov, belovpavel…) are probed with a fast pass first; only those with same-name accounts get a full scan.
Limits: depth by plan (1–3 rounds), up to 14 identifiers per scan, up to 8 permutations.
Each link keeps where it came from (via) and why: that is the graph in the report.

Confidence per account

The engine scores each account, the score gives a level. Table below.

A name match weighs most, a mismatch is a heavy minus.
Each recursion round lowers the score: an account from a name permutation is weaker than one from the nick itself.
Strong sites (GitHub, Keybase, Gravatar and the like) add a point: accounts there are usually real.

Judge: namesakes and strangers out

On top of the engine result Oracul reviews every account. The result file is untouched, so it can be re-judged.

Names with transliteration: Андрей = Andrey = Andrei = André. Brands and site titles are not names.
First name fits, surname is someone else's: another person.
Shared nick: when one nick belongs to several people, its accounts without the subject's name prove nothing.
Faces: faces on avatars are compared (local YuNet + SFace models, similarity threshold 0.5). Same face as the reference: accepted; another face in a later round: rejected.
User marks: "this is them" makes an account the reference (its face too), "not them" removes it and everything found only through it.
Interest zones: later-round accounts with different faces stay when their interests overlap the seeds'.

Profile

Accepted accounts make the scan's public profile.

Passport: names, nicks (only with an accepted account), emails, phones, location, timezone, work, links, avatars.
Completeness: share of 10 fields: names, nicks, emails, phones, location, timezone, work, links, avatar, at least one high-confidence account. Empty fields come with a hint.
Graph of linked identities: who was found through whom and in which round.
Timeline: registration and activity dates; the earliest one is the footprint age.
Portrait: occupation, hobbies, interest zones, last activity — rules, no LLM.

Enrichment

After the profile, separate steps, each can be re-run.

Publications: open endpoints without login: GitHub, GitLab, Habr, HuggingFace, Codeforces, Scratch, dev.to, Medium, Telegram channels, Bluesky. VK, X, Instagram, TikTok, Facebook need a login: marked "closed", not touched.
Telegram: the public t.me page, own channels (nick in the description) and public channels naming @nick. Subscriptions are private and not collected.
The prose summary is written by Claude. Only the minimum goes out: names, city, public bios and links, interest zones, dates. Never emails, phones or breaches.

Output

One result: console, file and API.

Console: scan page, accounts with decision and evidence, "this is them / not them" marks with re-judging.
Report: cover, completeness and passport, then sections — PDF via print or an HTML file.
API: /v1/scans, /accounts filtered by confidence, signals for pipelines. OpenAPI spec under API docs.
Completion webhook: HMAC-SHA256 signature t=…,v1=…; https only, public addresses only (SSRF guard).
Scans and result files are deleted after 30 days.

How confidence is scored

Points per account:

Name matches+3
Name mismatches−5
Name unknown0
Found by several engines+1 per extra, up to +2
Profile data present+1
Strong site+1
Confirmed registered+1
Recursion round−1 each

≥ 3high

1–2medium

−2…0low

≤ −3different person

Decision per account

confirmed high confidence✓
probable medium confidence✓
anchor marked "this is them"✓
face_match same face as reference✓
weak low confidence✕
namesake namesake✕
name_mismatch someone else's name✕
shared_nick shared nick✕
face_mismatch another face✕
face_conflict different people on avatars✕
excluded marked "not them"✕

Risk signals

Facts only, no score: the decision rules stay with the customer.

no_footprintno confirmed or probable account

young_footprintoldest account is under 180 days

name_mismatchprofile names differ from the stated one

voip_phonethe phone is VoIP

invalid_phonethe phone fails number validation

breached_credentialsemail in breaches with passwords (paid plans)

Products: what each takes from a scan

ProfileFull picture of a personpassport, graph, timeline, portrait

AntifraudSynthetics, account farms, dropsno_footprint, young_footprint, voip_phone

KYCDocument name against the webname_consistency, footprint age

AML / EDDContext for high-risk clientswork, links, breaches, publications

Counterparty checkWho is behind a partnername and title against profiles

Candidate screeningIs the candidate who they claimwork, footprint age, red flags

Security / exposureWhat an attacker seesbreaches, open emails/phones, nicks to try

Self-auditYour own footprinteverything found about you

APISame from your backend/v1/scans, signals, webhook

What Oracul does not do

No logging into accounts, no login bypass: closed networks are marked "closed".
No emails or password resets to the subject: every engine runs quiet.
Photos never leave: faces are compared by local models on the server.
Only public names, bios and links go to Claude; no emails, phones or breaches.
No Telegram subscriptions or private data.
Results are kept 30 days, then deleted.