In May, Wheel of Fortune announcer Jim Thornton was on an American Airlines flight when he fired up his Tor browser and visited lifeline[.]chat, a chatroom for pedophiles. A nearby passenger realized what Thornton was doing and alerted airline staff. Law enforcement met Thornton when the plane landed, according to reporting from TMZ.
While in the air, Thornton apparently felt that his use of Tor and an online handle, “NicholasB77,” would protect his identity. When another chatroom participant expressed concern, Thornton wrote, "What if someone sees a random sequence of lines on a screen. I love it. I hide the part that says ‘Lifeline’ so it's just a few lines. It's a big middle finger to da man who takes away every other enjoyable activity."
Not long after TMZ’s story, journalist Dean Sterling-Jones took Thornton’s handle (NicholasB77) and searched for other online accounts with the same username. Here’s the opening of his resulting story:
A LAWYER FOR JIM THORNTON says he only visited lifeline[.]chat—an illicit chatroom for paedophiles—by mistake, believing it was a suicide prevention site. But someone with the same username was active for at least two years on another paedophilia forum, where they posted a photo of a topless boy, professed their love of lifeline[.]chat, compared being a paedophile to being a Jedi, advised other members on how to hide their secret, and left comments like “I am wearing only a diaper.”
Sterling-Jones told me that even if he “wasn't able to definitively prove that Jim Thornton was behind the boychat account … it seemed newsworthy that someone with the same idiosyncratic username was active on a second, seemingly connected child abuse forum. Not only that, NicholasB77 had posted several comments enthusiastically directing other users to the very chatroom that Thornton can be seen using in photos published by TMZ.”
Usernames are useful in any investigation. People reuse usernames because it’s easier to remember or because they want to make it part of their brand. Maybe it’s a childhood nickname, a tribute to a favorite character, or a combination with their initials or favorite sports team. Even those engaged in shady or illegal behavior cut corners and reuse usernames. Such habits and mistakes are just the opening an investigator needs.
I think the first username search (aka username enumeration) tool I used was Namechk. Here’s what it looked like in the fall of 2009:
It checked for accounts on 72 platforms. Today you can use a web-based tool like WhatsMyName.app to search more than 600 online services for a username hit. Or you can use a command-line tool like Maigret to check thousands. These tools tell you whether an account exists with that username on a platform. But it’s up to you to verify whether it belongs to your target.
Those aren't the only options. There’s a wide range of free and paid username search tools, including a new breed of apps that enrich results with profile images and other data to speed up the process. It’s tough to know which tool(s) to use, so I ran manual and automated tests of 10 username search tools and spoke to some of their creators, including Micah Hoffman, Nicole Hurey, and Dmitry “Soxoj” Danilov.
The result is a username search playbook anyone can use to enhance their investigations.
Upgrade to read the rest
Become a paying member of Indicator to access all of our content and our monthly members-only workshop. Support independent media while building your investigative skills.
UpgradeA membership gets you:
- Everything we publish, including new investigations, OSINT guides, and intelligence reports
- A spot in our monthly investigative workshops where you can learn new skills and ask questions, plus always-on access to recordings, slides, and transcripts,
- Additional queries and MCP/API access for OSINT Navigator, our app to help you find the right tool for your investigation
- Unlimited access to all archival content, including guides and the Academic Library
