Skip to content
HackIndex logo

HackIndex

Name-to-Account Mapping Techniques

3 min read Apr 11, 2026

Overview

Name-to-account mapping finds digital accounts, profiles, and online presence attached to a real name. The challenge is disambiguation: common names return hundreds of results across platforms, and the goal is to isolate the correct individual from the noise. Combining the name with known context — employer, location, profession, or age — is the primary technique for disambiguation.

Generating Username Candidates From a Name

Before searching platforms directly, generate likely username patterns from the name. People frequently create usernames derived from their real name, especially on professional platforms and in email addresses. Feed the name through variation generation and run the candidates through Sherlock to find accounts across platforms simultaneously.

Search Engine Name Queries

Direct search engine queries with context terms are often the fastest starting point:

"John Smith" "London" linkedin
"John Smith" "software engineer" site:github.com
"John Smith" "@gmail.com" OR "@outlook.com"
"John Smith" "example.com"
"John Smith" filetype:pdf CV OR resume
"John Smith" "born" OR "age" site:news.com

Adding an employer name, city, profession, or domain significantly narrows results for common names. If you have any contextual detail from earlier in the investigation, use it here.

LinkedIn

LinkedIn is the most reliable platform for real name to professional identity mapping. Search by name and filter by location, company, or industry. LinkedIn profiles frequently contain employment history, education, profile photos, and sometimes personal email addresses or phone numbers in the contact section.

LinkedIn's own search is sufficient for most lookups. For bulk searches or when LinkedIn rate-limits your account, use Google with a site restriction:

site:linkedin.com/in "John Smith" "London" "software"
site:linkedin.com/in "John Smith" "Example Company"

Profile URLs on LinkedIn follow the format linkedin.com/in/firstname-lastname or linkedin.com/in/firstname-lastname-hash. The URL slug itself sometimes reveals a username the subject uses elsewhere.

Facebook

Facebook people search returns public profiles matching a name. Results are most useful when the subject has a public profile or when you have mutual connections that expand visibility. Combine name search with workplace or location filters.

Graph search is no longer available but direct URL patterns still work for some lookups:

https://www.facebook.com/search/people/?q=John%20Smith
https://www.facebook.com/search/people/?q=John%20Smith&filters={"city":"London"}

Pipl and People Search APIs

Pipl aggregates identity data from social networks, public records, and commercial sources and is searchable by name, email, phone, or username. It is a paid service used widely in investigative and due diligence contexts:

┌──(kali㉿kali)-[~]
└─$ curl -s "https://api.pipl.com/search/?first_name=John&last_name=Smith&country=UK&key=$PIPL_API_KEY" | jq '.person.names, .person.emails, .person.usernames'

Pipl returns a confidence-scored identity record combining multiple sources. Higher confidence scores indicate more corroborating data points across independent sources.

Confirming Identity Across Results

When you have multiple candidates with the same name, use the following to identify the correct individual:

  • Profile photo consistency across platforms

  • Employment history matching known context

  • Location data consistent with other intelligence

  • Account creation dates consistent with the subject's known online history

  • Mutual connections with other confirmed accounts

  • Writing style and vocabulary matching known samples

Document the evidence for each confirmation decision. An intelligence product that names a specific individual needs a clear chain of reasoning from evidence to conclusion.

References