Investigations

A scan answers "where does this username exist?". These options go a step further: which of those profiles are the same person, what else they link to, and what changes over time. All of them start from a normal scan and add to its report.

#Linking profiles: --correlate

aliens_eye someone --correlate

After the scan, Aliens Eye reads every Found and Maybe profile and compares them in pairs on four signals:

• avatar: a perceptual hash of the profile picture, so the same photo matches even resized or recompressed (needs the correlate extra, Pillow);
• display name, normalised;
• bio, as a set of words;
• links in the bio: the same personal site or handle on two profiles.

Profiles that match are joined into clusters, each one "likely the same person", with the signals that joined them. Without Pillow, or when an avatar fails to download, correlation still runs on the other three signals.

A cluster is a hypothesis. Two people can share a common name and a default avatar; one person can use a different photo everywhere.

#Following links: --recurse-depth

aliens_eye someone --recurse-depth 1

Profiles often point to other accounts: "also @someone_dev", a link to a GitLab page. With --recurse-depth N, Aliens Eye reads the bios of Found and Maybe profiles for @handle mentions and for links that are profile URLs on any catalog site (linkedin.com/in/<user>, <user>.tumblr.com; a link to a repository is correctly not taken for a profile). Up to 25 new usernames per round are scanned too, up to N hops away. Each hop is a full scan per username, so start with 1.

#Checking domains: --domains

aliens_eye someone --domains

Checks someone.com, .io, .net, .org, .dev, .me, .co and .app: whether the name resolves in DNS (so it is registered and points somewhere) and whether it serves a website. It uses plain DNS and HTTP, with no whois service or API key. A domain with the same name is a lead, not a link: plenty of common names are taken by someone else.

#Watching for changes: --watch

aliens_eye someone --watch 6h
aliens_eye someone --watch 1d --notify https://hooks.example.com/aliens

Watch mode scans again on an interval (30s, 15m, 6h, 1d) until you stop it, saving a timestamped report each time and reporting what changed: profiles that appeared, and profiles that disappeared.

• The first scan only records a baseline; nothing is reported as new.
• A failed request is not taken as a deleted account. Only a site that answers "no such user" counts, and only after --watch-confirmations scans in a row (default 2), so one flaky answer does not raise an alarm.
• --watch-profile name,bio,avatar also reports when a profile's display name, bio or avatar changes. Avatars are compared by their URL, not their pixels.
• --notify URL POSTs each change as JSON to a webhook (Slack, Discord, ntfy, your own endpoint).

#Long scans: --resume

aliens_eye someone -l advanced --resume someone.jsonl

Every finished site is appended to the checkpoint file as it completes. If the scan is interrupted, by Ctrl+C, a crash or a lost connection, run the same command again: the sites already in the file are skipped and their results reused.

#Comparing two reports: diff

aliens_eye diff results/someone_basic_20261101_090000.json results/someone_basic_20261107_090000.json
aliens_eye diff old.json new.json --json-stdout

Compares two saved reports without scanning anything: profiles found only in the newer one, profiles no longer found, sites whose status or confidence moved, and changed display names, bios and avatars.

#Graphs for other tools

aliens_eye someone --correlate --format gexf,mermaid,maltego

Exports the profiles, and with --correlate the clusters joining them, as a graph: GEXF for Gephi, a Mermaid diagram for Markdown documents, and a CSV Maltego can import. See Reports.

#Labelling uncertain results: label

aliens_eye label results/someone_basic_20261107_120000.json --out labeled.csv

Walks through the Maybe results of a report (--band all for every result) and asks, for each, whether the profile is real: y, n, s to skip, q to stop. Check the URL in a browser before you answer. Each answer is turned into a training row from the features already stored in the report, and appended to the CSV, which the model can be retrained on; see Training the model.