Blackbird -- an OSINT tool that takes a username or an email address and checks hundreds of sites for a matching account.
Alternative to: Maltego Professional at €7,500 per seat per year for the 20,000-credit tier. Spokeo's consumer tier runs a $0.95 seven-day trial into $19.95/month, with "all sales are final" written into its own payment policy. Pipl publishes nothing; procurement data from Vendr puts the average annual contract at $58,342, ranging $3,000 to $130,000.
Cost to run: free to install. No API key needed for the core searches. At any volume you will need your own proxies, because it fires unauthenticated requests at 700+ third-party sites with no rotation built in.
Licence: none. There is no LICENSE file and the GitHub API returnslicense: null. That means default all-rights-reserved copyright applies and commercial reuse or redistribution rights are legally ambiguous.
Runs on: anything with Python -- Linux, macOS, Windows -- or the bundled Dockerfile. CI tests against Python 3.11. No minimum version is documented.
Requires:git clonepluspip install -r requirements.txt. It is not on PyPI --pip install blackbird-osintreturns 404. The optional AI profiling add-on needs a key from the project's own backend, free with an undisclosed daily limit.
Traction: 7,680 stars · 871 forks · 18 contributors · ~645 commits · 10 open issues / 61 closed.
Liveness: stalled -- last commit 2025-07-13, no release ever tagged, and the issues that close are being closed by a stale-bot rather than a person.
Maturity: no version number exists. The project has never cut a release.
Links: repo · Trendshift peak #3 on GitHub Trending, 2025-07-22
Figures as of 2026-08-18.
What it does
You give Blackbird a username. It goes and asks several hundred websites whether that username exists there, and hands back a list of the ones that said yes, with links.
It does the same trick for email addresses against a much smaller set -- Gravatar, Adobe, Duolingo, Chess.com, Notion, Spotify, Strava, Twitter, and a handful of others.
This is account enumeration, and it is the first move in most open-source-intelligence work: establish where a person exists online before looking at what they posted. Investigators, recruiters, fraud teams and journalists all do a version of it. So do people with worse motives, which is why the tool ships a disclaimer.
Two numbers about coverage are worth separating. The README advertises "600+" sites. The username list is not in the repo at all -- it is pulled live at runtime from the WhatsMyName project's data file, which currently holds 716 sites. The email list is bundled and static, and it has 16 entries. One of those numbers self-heals as somebody else maintains it. The other has not moved since July 2025.
What it replaces, and what that costs
Commercial OSINT is priced like enterprise software and sold like it too.
Maltego is the only one in this category that prints a real number. Maltego Professional -- the Standard tier, 20,000 credits a month -- is €7,500 per seat per year, published openly. The Advanced tier at 40,000 credits, and Enterprise above it, are both contact-sales.
Social Links, which sells SL Pro and Crimewall into the same buyers, publishes nothing. Their own FAQ says it plainly: "Customers' needs differ greatly, which is why Social Links practices flexible, individual pricing. Contact the sales team for a quote."
Pipl publishes nothing either. The only real figures come from third-party procurement data: Vendr reports an average annual contract value of $58,342, with observed deals from $3,000 to $130,000. That is transaction data, not a price sheet, and it should be read as such.
At the consumer end, Spokeo sells the same lookup to individuals with a different trap. Checkout pricing runs a $0.95 seven-day trial, converting to $19.95/month, or $44.85 quarterly, with a "Professional" tier at $69.95/month. Spokeo's own payment policy is the part to read: trials "convert to an ongoing subscription" unless cancelled before 11:59 PM Pacific on the last trial day, plans "automatically renew," and "all sales are final."
Blackbird costs nothing to install and needs no key. The cost that shows up in practice is infrastructure rather than licensing: it fires direct outbound requests at 700-plus third-party endpoints per run, with no proxy rotation and no throttling. Anyone running it at volume trips rate limits and IP blocks, and buys proxies to get around that. Blackbird neither provides nor documents this.
And the licence status is not a footnote. With no LICENSE file, "free" describes the price, not your rights. A company that wants to build this into a paid workflow has no grant to point at.
Is it still alive?
No. This entry is an autopsy, and the liveness evidence is the reason it is worth publishing.
The last commit was 2025-07-13 -- over thirteen months before these figures were taken. No release has ever been tagged; the Releases page reads "There aren't any releases here."
The activity that looks like maintenance is not. The repo runs .github/workflows/auto-close-issues.yaml, an actions/stale@v7 bot that closes any issue or pull request after 30 days of inactivity plus a seven-day grace period. The healthy-looking 61-closed count is substantially that bot.
Issue #197, opened 2026-08-04, has no maintainer response and is still open. The maintainer's X account last posted in October 2023.
The rot shows up exactly where you would predict for a tool that scrapes other people's sites. Issue #160, "Instagram feature not working," has been open since 2026-03-04 and cannot be fixed by anyone because nobody is committing. Issue #139, titled simply "False Positive," has been open since 2025-07-13 -- the same day as the last commit. Issue #82 reports inconsistent results across identical searches, which is what throttling looks like from the client side.
The one part still improving is the part somebody else owns: the WhatsMyName dataset it pulls at runtime keeps growing whether Blackbird is maintained or not.
For what it is worth, it did have a moment. Trendshift records #3 on GitHub Trending on 2025-07-22 -- nine days after the last commit.
What people say
Thin signal, and the reason is worth stating. Reddit is blocked from the research sandbox: Firecrawl returns "we do not support this site" and direct fetches return 403. I could reach search-engine snippets but not comment permalinks, so no vote counts are claimed as verified below.
The original r/netsec announcement thread, "Blackbird: An OSINT tool to search for accounts by username," indexes at 237 upvotes and 8 comments: reddit.com/r/netsec/comments/wirjlz
From r/OSINT's "List some of your favourite and most useful osint tools," an excerpt surfaced without a retrievable permalink:
"For usernames I like maigret, alfred, and blackbird. Sherlock sucks."
-- thread: reddit.com/r/OSINT/comments/195rd2a
And the dissent, from a thread about a competing tool, attributed to u/cjvacopa about six months ago: "What makes this better than blackbird?" -- reddit.com/r/OSINT/comments/1rgqnso
Hacker News has no dedicated thread for it at all. That silence is itself part of the record.
The catch
Nobody is fixing anything. Thirteen months without a commit, and an issue filed this month with no reply.
False positives are an open, acknowledged bug. Issue #139, unresolved since July 2025. Results are string and status-code matches against live third-party endpoints; a green tick is a hypothesis, not a finding. Every hit needs manual confirmation.
Site modules rot faster than anything else in software. Targets add bot protection continuously. Instagram support has been broken since March 2026 with no path to a fix.
No licence. Not permissive, not copyleft -- absent. Commercial use rests on nothing.
The legal and ethical exposure is yours. The project's own disclaimer, verbatim:
"This or previous program is for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that me (P1ngul1n0) is not liable for any damages caused by direct or indirect use of the information or functionality provided by these programs."
Running username enumeration against a real person without their consent is the line the author himself draws, and disclaims all liability for crossing.
If you want a maintained free option, Sherlock occupies the same space and is still developed. Blackbird's advantage was the interface and the email module, and the email module is 16 sites frozen in July 2025.
Credits
Lucas Antoniaci (p1ngul1n0, @p1ngul1n0), who built it and named himself Project Developer in the README. The WebBreacher/WhatsMyName project, which maintains the 716-site dataset Blackbird depends on and is the only part of this stack still being updated. The 18 contributors on the repo. Pricing verified against Maltego and Spokeo's own pages, Social Links' FAQ, and Vendr's procurement data for Pipl; peak rank from Trendshift.