Sites and catalogs

A catalog is the list of sites Aliens Eye knows how to check, with a URL template for each (https://github.com/{}) and, for many, rules about what a missing profile looks like and which usernames the site allows.

#The two catalogs

Catalog	Sites	Use
`extended` (default)	7,710 enabled	Every scan, unless told otherwise.
`standard`	788	The original hand-kept list: a tenth of the requests, so about ten times quicker. Evaluation and training use it.

bash

aliens_eye someone                       # extended
aliens_eye someone --catalog standard    # standard

"catalog": "standard" in the configuration makes the standard catalog the default.

The extended catalog combines two pinned community site databases (Maigret's and Sherlock's, both MIT) with the unique, valid templates of the standard one. Entries for the same profile URL are merged into one, keeping the other names as aliases. It keeps each source's rules: separate profile and API-probe URLs, username constraints, tags, the upstream revision and file hashes.

#How the catalog was checked

Every entry was checked live on 2026-11-07 with one username known to exist and one made up:

68 sites reported the made-up username as existing (false positives), and 877 failed twice, once more on a second pass with longer timeouts (605 unreachable, 272 no longer finding the known account). These are disabled in the extended catalog and removed from the standard one, except 56 standard sites the ground-truth splits depend on.
About 4,900 of the remaining sites confirmed the known account and rejected the made-up one. The rest answered the checking network with blocks, challenges or pages that could not be judged.

A check is a snapshot from one network on one day, not a guarantee: sites change.

#Choosing sites for a scan

bash

aliens_eye someone --site github,gitlab,codeberg   # names containing these words
aliens_eye someone --exclude-site facebook,tiktok  # skip these
aliens_eye someone --tag coding                    # sites tagged "coding"
aliens_eye someone --source sherlock               # entries from one source
aliens_eye someone --no-nsfw                       # skip adult sites

Filters can be combined, and match aliases as well as names.

#Inspecting a catalog

bash

aliens_eye sites stats --catalog extended            # counts by source, tag, state
aliens_eye sites list --catalog extended --tag coding
aliens_eye sites validate --catalog extended         # check every definition is well formed
aliens_eye sites list --catalog extended --json      # machine-readable

These subcommands read the standard catalog unless you pass --catalog extended.

#Adding your own sites

Put a JSON file mapping a name to a URL template, with {} where the username goes, into a sites.d directory:

json

{
  "my-forum": "https://forum.example.com/u/{}",
  "my-wiki": "https://wiki.example.com/User:{}"
}

Files in ./sites.d/ and in sites.d/ under the user configuration directory are merged into every scan automatically. --sites-dir DIR adds another directory.

To scan only your own list instead of a catalog, pass it with --sites:

bash

aliens_eye someone --sites my-sites.json

A site added this way is judged by the general detector alone; there are no per-site rules for it.

#Importing a site database

sites import reads a local copy of Maigret's or Sherlock's data.json. It downloads nothing and runs none of their code. Without --out it only reports what it would import; with --out it writes a new catalog file and refuses to overwrite one:

bash

aliens_eye sites import --maigret path/to/maigret/resources/data.json --with-standard --out imported.json
aliens_eye sites import --sherlock path/to/sherlock_project/resources/data.json --out sherlock.json
aliens_eye someone --sites imported.json --explain

--maigret-revision and --sherlock-revision record which upstream revision you reviewed. The SHA-256 recorded identifies the file you supplied; it does not prove the file came from the project.

Only public GET requests are supported. Entries that need a login, credential headers, POST bodies, unsupported regular expressions or ambiguous searches are left out rather than treated as supported. Imported sites do not use the browser fallback.

#Checking which sites still work

scripts/verify_catalog.py, in the repository, repeats the live check above: for each enabled site it requests a username known to exist and a made-up one, then judges the stored answers offline with the scanner's own per-site check.

bash

# live: about two requests per site; run it again to resume
python scripts/verify_catalog.py record --corpus runs/verify --upstream-data path/to/data.json
# offline: summary.json and sites.csv with a verdict per site
python scripts/verify_catalog.py report --corpus runs/verify --out runs/verify-report
# dry run unless --write: disable the sites found broken
python scripts/verify_catalog.py apply --report runs/verify-report --recheck runs/recheck-report

The verdicts are working, alive_no_test_user, misses_known_user, accepts_anything (a made-up username reported Found), uncertain, blocked and unreachable. Upstream "known" accounts can be deleted, so misses_known_user alone does not prove a rule is broken.

#Licences of the data

Maigret and Sherlock data keep their MIT notices, recorded in the catalog's source metadata. Ground-truth records marked source: whatsmyname come from the WhatsMyName project, © 2015–2026 Micah Hoffman, under CC BY-SA 4.0, and must not be relabelled MIT. The project's MIT licence covers its code, not third-party data.