OSINT as an API
Know who is behind the handle.
Oracul turns a username, email or phone number into a verified digital footprint profile: accounts on 3,000+ sites, linked identities, breach exposure and a timeline. One request, structured JSON back.
Plugs intoAntifraudKYCAML / EDDTrust & Safety
Public sources only. The subject is never notified.
# start a scan
curl -X POST https://api.oracul-systems.com/v1/scans \
-H "Authorization: Bearer $ORACUL_KEY" \
-d '{
"seeds": { "username": "jdoe", "email": "jdoe@example.com" },
"name": "John Doe",
"depth": 2,
"webhook_url": "https://you.example/hooks/oracul"
}'
# 202 Accepted
{ "id": "scn_8f2k1q", "status": "queued", "eta_seconds": 720 }- 3,000+
- sites checked per username
- 4
- independent scan engines
- 3
- rounds of identity pivoting
- 0
- notifications sent to the subject
How it works
From one seed to a full profile
- 01
Seed
Send what you know: a username, an email, a phone number. A full name sharpens the match and filters out namesakes.
- 02
Scan
Four engines check thousands of sites in parallel, extract public profile fields and look up breach records for every email.
- 03
Pivot
Links in bios, Keybase proofs, Gravatar accounts and commit emails reveal new handles. They are scanned in the next round.
- 04
Profile
Accounts are merged, scored by confidence and assembled into one profile: identity, linked graph, timeline, exposure.
Antifraud · KYC · AML
A digital-footprint layer on top of your risk stack
Documents and selfies prove that a person exists. Oracul shows whether they have lived online: a real customer has years of accounts under one name, a synthetic identity or a mule account has none. Add one call to onboarding or to a case review and feed the signals into the rules you already have.
- 01Signup or payout
- 02Your KYC / IDV
- 03Oracul signals
- 04Your rules engineapprove · step-up · manual review
Antifraud
Catch synthetic identities, account farms and card testers: no footprint, a footprint that started last month, VoIP numbers, one email behind many signups.
KYC
Cross-check the name from the document against public profiles. Name consistency and footprint age are features for your scoring model, not a verdict.
AML / EDD
Enhanced due diligence context for high-risk customers and counterparties: who they are online, linked identities, business profiles. It adds to sanctions and PEP screening, it does not replace it.
Your rules decide
Oracul returns facts and flags, never an approve or decline. Every check is logged with its purpose, ready for an audit.
"signals": {
"footprint_age_days": 23,
"confirmed_accounts": 0,
"name_consistency": 0.2,
"breach_count": 0,
"phone_voip": true,
"flags": ["young_footprint", "name_mismatch", "voip_phone"]
}Flags
- no_footprint
- no confirmed accounts at all
- young_footprint
- oldest account is under 6 months
- name_mismatch
- profiles carry a different name
- voip_phone
- virtual or VoIP phone number
- breached_credentials
- passwords in known breaches
What you get
A profile, not a list of URLs
Every account carries its sources and a confidence level. Namesakes are flagged as a different person instead of being mixed in.
Identity passport
Names, handles, emails, location, timezone, workplace and links — collected from profiles that match the subject.
Linked identity graph
Which handle led to which, and why: bio link, Keybase proof, commit author, Gravatar account.
Accounts with confidence
High, medium, low — plus “different person” when the profile name does not match.
Breach exposure
Known leaks per email with the exposed fields, so you can see what is already out there.
Timeline
Registration dates and last activity across platforms, in one chronological view.
Phone analysis
Region, carrier and line type parsed offline, with messenger deep links. No calls, no lookups that touch the number.
Use cases
Built for teams that need to know
- 01
Fraud & KYC
A real person has years of footprint. A synthetic identity has none. Score signups before they reach payouts.
- 02
Security teams
Map exposed accounts and leaked credentials across your own organization before an attacker does.
- 03
Pentest & red team
Recon for engagements in scope: employee handles, reused emails, exposed profile data — in minutes.
- 04
Trust & Safety
Link ban-evading and coordinated accounts on your platform through shared handles and emails.
- 05
Due diligence
Check that a counterparty, founder or contractor is who they claim to be online.
- 06
Self-audit products
Show your users their own digital footprint and breach exposure, with their consent.
API
Asynchronous, predictable, boring in the best way
Start a scan, get a webhook when it is done, fetch the profile. Fast mode returns in minutes; a full depth-2 scan takes 10–20.
- POST
/v1/scansStart a scan from one or more seeds - GET
/v1/scans/{id}Status, progress and the profile when done - GET
/v1/scans/{id}/accountsPaginated accounts with sources and confidence - GET
/v1/scans/{id}/graphLinked identity graph: nodes, edges, reasons - DELETE
/v1/scans/{id}Erase the scan and all of its data
Console
The whole profile, in the browser
console.oracul-systems.com runs the same engine with a UI on top. Enter what you know about the subject, watch the scan pivot in real time and get a complete profile you can export.
- Guided /osint form: username, email, phone, full name, known location
- Live progress by round and engine
- Profile completeness score and what is still missing
- Export to HTML or JSON, share inside your team
- API keys, usage, team seats and the audit log
Pricing
Pay for scans, not seats
Every plan includes the API and the console. A scan is one subject, however many seeds and pivots it takes.
Free
Try the engine
$0/mo
- 25 scans per month
- Fast mode, depth 1
- Console + API
- 10 requests / minute
- Most popular
Pro
For analysts and small teams
$79/mo
- 1,000 scans per month
- Full mode, depth 2
- Breach exposure
- Webhooks
- $0.08 per extra scan
Business
For fraud and security teams
$399/mo
- 10,000 scans per month
- Depth 3, priority queue
- 10 console seats, SSO
- Audit log export
- $0.04 per extra scan
Enterprise
Volume and compliance
Custom
- Dedicated workers
- Regional proxies
- 99.9% SLA, DPA
- On-premise option
Early-access pricing. Limits may change before general availability.
Responsible use
Powerful data needs clear rules
Oracul works only with publicly available information and only for legitimate purposes.
Public sources only
Public profiles, public commits, public breach indexes. No private data, no account access, no scraping behind logins.
Silent by design
No password-reset probes and no checks that email the subject. Loud modules are off and not available via API.
Know your customer
Paid keys belong to verified organizations with a declared use case. Every query lands in the audit log.
Retention and erasure
Results are stored for 30 days, then deleted. Erase any scan earlier with one API call.
FAQ
Questions
Where does the data come from?
From public sources only: public profile pages on 3,000+ sites, public APIs (GitHub, GitLab, Keybase, Gravatar), public commit metadata and public breach indexes.
Will the person know they were looked up?
No. Oracul does not trigger password resets, sign-up attempts or any check that sends the subject an email or notification.
How accurate is it?
Every account carries a confidence level and the sources behind it. “Low” means the handle exists but nothing confirms it is the same person. Providing a full name greatly reduces false matches.
How long does a scan take?
Fast mode: a few minutes. A full depth-2 scan with pivoting: 10–20 minutes. You get a webhook when it is done.
Can I scan by phone number?
Phone numbers are parsed offline: region, carrier, line type and messenger links. We do not probe messengers by number.
Is it GDPR-compliant?
Oracul processes only public data, keeps results for 30 days, supports erasure via API and signs a DPA on Business and Enterprise. You remain responsible for having a lawful basis for each scan.