More than 400 sites produce leads, not identity proof
Sherlock takes a username and requests possible profile URLs across more than 400 social networks. One command can search several names, limit checks to chosen sites, route requests through a proxy, and save results in text, CSV, XLSX, or JSON-oriented output. That makes it useful for the first pass of an OSINT investigation, when the immediate question is where a handle appears on the public web.
A result means the site's configured test looked like a claimed account. It does not prove that the page belongs to the subject. Handles are reused, pages change, and sites return different content by region or bot policy. Sherlock's own release notes discuss false-positive reduction rather than elimination. A competent workflow opens the profile, compares biographical details and linked accounts, and records uncertainty. The CLI saves time finding candidates; it does not perform attribution.
Version 0.16.0 filters noisy sites unless you override it
The September 16, 2025 release added automatic filtering for sites prone to false positives. Upstream tests maintain an exclusion list, and the command normally respects it. The --ignore-exclusions option exists for researchers who want a wider net, while its help text warns that more false positives may appear. That tradeoff is honest and should remain visible in any wrapper built around Sherlock.
Open issue 3074, updated on August 26, 2026, reports recurring false positives for Tweakers, Chess, Instagram, and YouTube. Another open request explains why sites that load profile state through later Fetch or XHR calls can defeat raw HTML checks. These reports fit the nature of the tool: every target is an external dependency with its own redirects, WAF, rendering, error pages, and anti-automation rules. Site definitions need continuing maintenance.
What happened when we ran it
Our sandbox installed commit 9100f9d in 103 seconds. The run added 46 Python packages and used 148 MB on disk. Its build completed in 9 seconds. Pip-audit found 0 known vulnerabilities in the installed environment. The checkout was small, with 55 files, about 2,210 source lines, and 1.3 MB before dependencies.
Pytest ran for 20 seconds and exited 1. It reported 22 passed, 1 failed, and 2 collection or setup errors out of 25. The failed live-target case expected the known AllMyLinks username blue to return CLAIMED, while Sherlock classified the response as WAF. The log does not say why that target returned a WAF status, so regional blocking, target changes, and network policy remain possibilities rather than findings.
The two errors occurred while collecting or setting up tests/test_manifest.py and tests/test_validate_targets.py. The supplied tail contains no fuller error text for those files. We therefore cannot assign a cause. The repository has a Dockerfile, a tests directory, and 4 CI workflows, but our exact fresh environment did not produce a clean suite. For an OSINT tool built on live sites, that red result is operationally important.
Python packaging is safer than two named distro packages
The README recommends pipx install sherlock-project, with pip or uv as substitutes. Docker and dnf are also listed. Community packages exist for several Linux distributions and Homebrew, though the project says those packages are not directly maintained upstream. It specifically warns that ParrotOS and Ubuntu 24.04 packages appear broken and tells those users to choose uv, pipx, pip, or Docker.
Basic searches do not require hosted credentials. A username is enough, and the default timeout is 60 seconds per response according to the command help. Large batches can still generate many requests, slow down on unresponsive sites, or trigger defenses. Proxies are supported, but using one changes the region and reputation seen by targets. Re-run important checks from a controlled environment and record the date because results age quickly.
Output needs a verification column before it becomes evidence
Sherlock writes found accounts to a username-specific text file by default. Structured exports make it easy to feed results into case notes or another analysis tool. Add fields for verification status, observed profile name, matching details, capture time, and reviewer. Without that second layer, a polished spreadsheet can hide the fact that its rows came from automated HTTP heuristics.
The --dump-response option helps debug one target, while --site narrows a run to selected services. Those controls are better for confirming an important result than repeatedly scanning all 400-plus sites. The --browse option opens results in a browser, which supports the manual-review step. Screenshots and archived URLs may be appropriate when the investigation has a lawful purpose and the material can change.
Active pushes matter more than the older release tag
GitHub showed 90,372 stars, 334 combined issues and pull requests, and a last push on August 26, 2026. The latest tagged release was v0.16.0 from September 2025, yet recent source activity and current issue discussion show that the project is still maintained. The combined GitHub count is not a defect total; it includes pull requests and many site-support requests.
Sherlock remains the easiest username-enumeration tool to recommend to a careful investigator. Installation worked, the build passed, and 22 tests passed in our sandbox. The WAF mismatch and 2 collection errors are a warning against treating target checks as stable facts. Keep the default exclusions, inspect every consequential result, and use Maigret or WhatsMyName when broader coverage or a reusable data source better fits the investigation.