Command reference

Searches for a username across multiple sites and reports where an account under that name exists.

Input

A username.

Returns

The sites where the handle resolves to a live profile, with links, and the ones that came back empty.

Worth knowing

• A hit means a profile with that name exists, not that the same person owns every match.
• Some sites block automated checks, so an absent result is not proof of absence.
• Nothing is sent to the profile owner. No follow, no view, no notification.

Searches for an email address across multiple sites and services.

Input

A full email address.

Returns

The sites and services where the address resolves to an account.

Worth knowing

• Run it on your own addresses to see what a stranger could learn from one of them.
• The address is sent to each service checked. See the privacy policy for what that means.

Checks a username or email for infostealer and credential exposure in known breach data.

Input

A username or an email address.

Returns

The breaches and infostealer logs the identifier appears in, with what each is known to have exposed.

Worth knowing

• Exposure means a credential leaked at some point, not that an account is compromised today.
• Treat any password reused since an incident as burned. Rotate it and turn on two-factor.
• Absence from the index is not a clean bill of health. Many breaches were never indexed.

Checks how many times a password has appeared in known breaches.

Input

A password.

Returns

The number of times the password has been seen in breach corpora.

Worth knowing

• A non-zero count means the password is in attackers' wordlists. Stop using it everywhere.
• Check passwords you are considering, not ones you actively rely on, and change any that show up.

Generates common password suggestions from personal details, using the CUPP approach.

Input

Personal details the profiler builds candidates from, such as names, dates, and keywords.

Returns

A list of likely password candidates derived from those inputs.

Worth knowing

• This is a security-testing tool. Use it to audit the strength of your own passwords or in an authorized engagement.
• Using it to guess someone else's password without authorization is prohibited and may be illegal.

Resolves a Discord user ID and searches for likely username matches elsewhere.

Input

A Discord user ID. Enable Developer Mode in Discord to copy one.

Returns

The account the ID belongs to, plus likely matches for that username on other sites.

Worth knowing

• Cross-site matches are suggestions, not confirmations. Same handle does not mean same person.
• Only public account information is used.

Looks up a Discord account's age, badges, and mutual servers.

Input

A Discord user, mentioned or given as an ID.

Returns

The account creation date and age, the badges on the profile, and the servers you share with it.

Worth knowing

• Account age is the strongest single signal when screening a suspicious join.
• Mutual servers reflect your own visibility, not a global view.

Runs a lookup against an Instagram account.

Input

An Instagram handle, with or without the leading @.

Returns

The public profile information the account exposes.

Worth knowing

• Private accounts return only what Instagram shows publicly.
• Read-only. The account is not followed, messaged, or notified.

Looks up a TikTok account's profile.

Input

A TikTok handle.

Returns

The public profile information the account exposes.

Worth knowing

• Read-only. Only public profile data is returned.

Looks up a Roblox account's profile.

Input

A Roblox username.

Returns

The public profile details for the account.

Worth knowing

• Read-only. Only public profile data is returned.

Looks up a Minecraft account's UUID and renders its current skin.

Input

A Minecraft Java Edition username.

Returns

The account UUID in dashed and undashed form, and a render of the current skin.

Worth knowing

• UUIDs are stable across name changes, so this is the reliable way to identify an account for whitelists and bans.
• Java Edition accounts only. Bedrock uses a different identifier scheme.

Geolocates an IP address, or looks up WHOIS and geolocation for a domain.

Input

An IP address or a domain name. A full URL is accepted for domains.

Returns

For a domain, registrar and registration records plus host geolocation. For an IP, its geolocation and network.

Worth knowing

• A domain registered days ago behind privacy protection is a common phishing signature. Check the creation date first.
• Most registrars redact registrant contact details under GDPR, so expect those to be withheld.
• Geolocation reflects where the host sits, not where the operator is.

Checks an image for QR codes, where else it appears online, and how likely it is to be AI-generated.

Input

An image attachment.

Returns

Any QR codes found and decoded, reverse-image matches showing where else it appears, and an AI-generation likelihood estimate.

Worth knowing

• Decoding a QR code is not the same as visiting it. Read the destination before you open it.
• The AI-generation likelihood is an estimate, not a verdict. Treat it as a signal, not proof.

Runs the prototype content-based site checker.

Input

The target the prototype checker accepts.

Returns

The prototype's assessment of the target.

Worth knowing

• This is an experimental prototype. Its behaviour and output may change or be removed.

Shows the app's rules and support information.

Input

None.

Returns

The usage rules and where to get help.

Worth knowing

• A quick way to reread the rules before you run a lookup.

Checks the app's current response latency.

Input

None.

Returns

The round-trip time for the app to respond.

Worth knowing

• Use it to tell a slow lookup apart from an app that is not responding at all.