Maigret OSINT Tool

Maigret is a powerful OSINT tool with the following capabilities:

• Massive Site Support: Supports 3000+ sites. By default, it checks the top 500 most visited sites. Use the -a flag for a full scan or --tags to filter by category/country.
• Recursive Search: Performs searches based on discovered usernames and other IDs.
• Data Extraction: Uses socid_extractor to pull information from profiles and APIs, including links to other accounts.
• Evasion & Access: Can detect and partially bypass blocks, censorship, and CAPTCHAs. Supports Tor and I2P sites.
• Automated Updates: Automatically pulls an updated site database from GitHub every 24 hours.
• Multiple Interfaces: Available as a CLI, a Python library, and a Web UI.
• AI Analysis: Optional --ai mode uses OpenAI-compatible APIs to summarize search results into an investigation summary.

Maigret can be used in three primary ways:

1. Command Line Tool: Run searches directly from your terminal using various modes (default or all sites).
2. Web Interface: View results in a graph format and download all report formats on a single page.
3. Library: Integrate Maigret's functionality directly into your own Python projects.

For sites requiring JavaScript challenges (tagged cf_js_challenge or cf_firewall), you can use an experimental feature to route checks through a FlareSolverr instance. This is optional and only required for specific protected sites.

1. Run FlareSolverr via Docker:

docker run -d -p 8191:8191 --name flaresolverr ghcr.io/flaresolverr/flaresolverr:latest

2. Run Maigret with the --cloudflare-bypass flag.

docker run -d -p 8191:8191 --name flaresolverr ghcr.io/flaresolverr/flaresolverr:latest
# Then use Maigret with:
maigret USERNAME --cloudflare-bypass

Maigret determines if an account exists on a site using one of three checkType methods defined in data.json:

• message: The most reliable method. It checks if any string from presenceStrs is present in the HTML response and ensures none of the strings from absenceStrs are present.
• status_code: Checks if the HTTP response status code is in the 2XX range.
• response_url: Checks that there is no redirect and the response status code is 2XX.

Note on Anti-bot handling: Maigret treats specific anti-bot HTTP status codes (e.g., LinkedIn's HTTP 999) as a standard "Not Found/Available" signal rather than a server error to prevent false positives.

Maigret can use OpenAI-compatible models to analyze search results and generate a neutral investigation summary (covering details like real name, location, occupation, interests, and confidence levels).

Configuration

• API Key: Set via the OPENAI_API_KEY environment variable or the openai_api_key key in settings.json.
• Endpoint: Defaults to https://api.openai.com/v1. You can change this using openai_api_base_url in settings.json to support Azure OpenAI, OpenRouter, or local servers.
• Model: Specify the model using the --ai-model flag.

export OPENAI_API_KEY=sk-...
maigret user --ai

# Use a specific model
maigret user --ai --ai-model gpt-4o-mini

By default, Maigret uses the url pattern for both the request and the reported link. If a site requires an API or JSON endpoint to check for account existence, use the urlProbe key in data.json.

• url: Must always be a human-openable profile page (e.g., https://github.com/{username}).
• urlProbe: The actual endpoint used for the presence check (e.g., https://api.github.com/users/{username}).

This ensures that Maigret performs an efficient check while still providing the user with a clickable, browsable link in the final report.

Once an ORCID is identified, Maigret can use the data within the academic record to find mainstream social media profiles through several pivot points:

• ORCID researcher-urls: Self-declared links to lab homepages, Twitter, Bluesky, or Mastodon.
• ORCID external-identifiers: Links to Scopus, ResearcherID, or Loop profiles.
• OpenAlex last_known_institutions: Provides ROR IDs and institution IDs to pivot into institutional directories.
• DBLP <url> tags: Often contains direct links to Google Scholar and ResearchGate.
• Scholia wikidata_qid: Provides a Wikidata QID which can be used via SPARQL to find identifiers for VIAF, LCCN, GND, IMDb, GitHub, and hundreds of others.

Maigret automatically parses account webpages to extract personal information (IDs, images, locations, etc.) and links to other profiles. It can also use discovered identifiers to initiate a recursive search, automatically starting new searches for usernames found in links.

• Personal Info Extraction: Enabled by default. Disable with --no extracting.
• Recursive Search: Enabled by default. Disable with --no-recursion.

In the Maigret web interface, the tag cloud allows you to toggle the inclusion or exclusion of tags through three distinct states:

1. Include (Green): The tag is active and will be used to filter results.
2. Exclude (Dark/Strikethrough): The tag is active as an exclusion filter.
3. Neutral (Red): The tag has no effect on the search.

Within the academic chain (ORCID, OpenAlex, arXiv, DBLP, Scholia), ORCID is the primary source for email addresses.

• Verification: Look for the history.verified-primary-email flag in the response; this indicates the address was validated at registration.
• Usage: Use these discovered emails as pivots for other OSINT tools like Holehe, HIBP, or Gravatar.
• Alternative: For scientists using GitLab (common in research institutes like CERN), the public_email field may leak an email address, whereas GitHub's REST API typically does not expose it by default.