Six former handles came out of six username subjects run on OSINTsearch on 2026-09-05, each with the platform that reported it and the raw field it was read from. Steam reported GammaCIA behind steamcommunity.com/id/cia with a change timestamp of 26 Dec, 2010. osu reported thegame98 behind richard and "African Anger" behind meme. Instagram reported mollyhalecia behind cia. archive.org reported the member name nervequake on the @deadcatx3 account. TikTok reported 5rh0e as a variant of srhoe. Every entry traces to a platform that still publishes name history, and those entries are worth more than most of the rest of the 1,439 rows in the same exports.
Former usernames are the single most under-used pivot in username OSINT. A current handle tells you where someone is today. A previous username tells you where they were, which archives to open, which breach rows to match, and which accounts elsewhere were registered under the older name and never renamed. This guide covers why handles change, what an old handle lets you do, which platforms expose username history, how osintsearch.org represents it, and how the same signal looks in the fingerprint.to, Revealer and osint.industries exports we have on disk. Full tool review at /blog/osintsearch-review-2026; the companion piece on deleted and banned accounts is at /blog/banned-suspended-accounts-osint.
Disclosure: we build Revealer.US. OSINTsearch is an independent tool with no relationship to us. Where its exports beat ours, and here they do, we say so.
Why people change handles
- Rebrands. A creator outgrows a teenage gamertag. A streamer moves from a personal name to a brand.
- Evasion. A user who was reported or called out renames to break the link between the old reputation and the current account. The account keeps its ID; only the label changes.
- Harassment and safety. Victims rename to shake off stalkers. The caution section below applies with full force.
- Account sales. Short and dictionary handles trade hands. The prior owner's history is now attached to a stranger.
- Scam rotation. Fraud accounts burn a handle, rename, and continue with the same followers, bio and payment links. The account ID and join date give it away.
In every case the account is the same object. The name is just the current pointer.
What a former handle lets an investigator do
A previous username is a search key into the past. Concretely:
| Pivot | What you run | What it can return |
|---|---|---|
| Archived pages | Wayback Machine and archive.today on the old profile URL | Bios, avatars, linked accounts and posts as they stood under the old name |
| Breach and stealer rows | Breach lookup on the old handle and on old handle plus common mail domains | Credentials and registration emails tied to the earlier identity |
| Old posts and mentions | Site search and full-text search for the old handle in quotes | Conversations, forum posts, replies and callouts that predate the rename |
| Cross-platform continuity | A fresh username search on the old handle | Accounts on other platforms registered under the old name and never renamed |
| Sockpuppet linkage | Compare old handle, join date, avatar and bio across the candidate accounts | Two current accounts that share one former name are a strong lead |
Two of those are worth running every time: a username search on the old handle, because the older name is often still live on platforms the person forgot about, and a breach lookup on it, because breach rows are dated and a row that predates the rename corroborates that one person held both names.
Which platforms publish name history, and how
The platforms below exposed a rename in the data OSINTsearch and fingerprint.to returned on 2026-09-05. The mechanism decides how much you can trust each entry.
| Platform | How history is exposed | What OSINTsearch returned | Field path in the JSON export |
|---|---|---|---|
| Steam | Public profile shows previous persona names with change timestamps | GammaCIA on /id/cia, changed 26 Dec, 2010 @ 12:44am; one earlier name on /id/meme, changed 16 Jun, 2011 |
platforms[].raw.name_history[].name plus changed_at, and raw.former_names[] |
| osu | Profile API returns a previous_usernames array | thegame98 on user 2525267 (richard); "African Anger" on user 5132040 (meme) |
platforms[].raw.previous_usernames[] |
| Not a public list; some responses carry an earlier handle for the account | mollyhalecia on the cia account (user ID 12630084296, joined April 2019) |
platforms[].former_usernames[] only; the raw block carries returned_username |
|
| Rainbow Six / Ubisoft | Tracker sites keep a name_history with change timestamps | Not in the OSINTsearch rows we opened; fingerprint.to returned it (below) | fingerprint: extras.name_history[].name and changed_at |
| NameMC (Minecraft) | Mojang name history by UUID | One entry on every run: CIA, Meme, Richard, davidbombal, DeadCatX3, srhoe, each with its UUID | platforms[].raw.name_history[].username |
| Bluesky | Handle changes are visible in the account's record | Not in the OSINTsearch rows we opened; fingerprint.to returned two earlier handles on cia.bsky.social |
fingerprint: extras.former_usernames[] |
| archive.org | Member page carries a screenname separate from the account identifier | nervequake on archive.org/details/@deadcatx3, member since 2023-05-17 |
platforms[].raw.account_details.screenname versus user_item_identifier |
| TikTok | Profile returns a handle that can differ from the queried one | 5rh0e, display name "Backup srhoe", user ID 7084331618885993477 | identity.username_variants[].value with sources: ["tiktok"] |
| ENS | On-chain name registered under the handle | davidbombal.eth, cia.eth, richard.eth | identity.username_variants[].value with sources: ["ens"] |
Three points from that table.
Steam is the richest single source. It gave a name and a timestamp in the same row, and OSINTsearch keeps both: former_names as a flat list and name_history as objects with changed_at. On the /id/meme account the normalized former_usernames is empty and the history only appears in raw.former_names and raw.name_history. Read the raw block. The normalized column is the summary, not the whole record.
NameMC entries are history, not former names. Every NameMC row carried a one-entry name_history holding the current name, which is what a Minecraft account with no rename looks like. A two-entry list is the signal.
Instagram is the odd one. The cia account's raw block does not contain the string mollyhalecia. It appears only in the normalized former_usernames column, so the tool derived it from a response field it does not dump into raw. It is the one entry we could not trace to a visible source field, and the one to verify by hand before it goes in a report.
How OSINTsearch represents former usernames
OSINT search tools tend to treat a rename as a footnote. OSINTsearch treats it as a column.
In the UI. Result cards show an "Earlier names reported for an account" line where a source supplied one; the site says former handles are returned "where sources still provide them". The identity panel lists username variants with the platform that supplied each.
In the JSON export (schema 2 and 3). Every row in platforms[] carries a former_usernames field, null on rows with no history and an array on rows that have it. Behind it sits raw{}, the untouched source payload, where the platform-native keys survive: name_history, former_names, previous_usernames. The identity block at the top carries username_variants, an array of {value, sources[]} objects. On cia it listed cia with 318 sources, then cia.eth from ens and six more variants, each pinned to its platform. On davidbombal: davidbombal with 58 sources and davidbombal.eth from ens. On deadcatx3: nervequake from archiveorg. On the 09:24 srhoe run: 5rh0e from tiktok.
In the CSV export. Three dedicated columns: former_usernames, former_usernames_count and former_usernames_truncated, alongside alias, account_status and account_status_reason. You can filter on the count without parsing a list cell, and the truncated flag tells you when to go back to the JSON.
The design choice that makes this useful is the split between normalized and raw. The column lets you sort 547 rows and find the one that matters in seconds. The raw block shows exactly what the platform said, including the Steam timestamp and the data_source: ashcon/mojang marker on NameMC rows.
How the other exports handle it
We opened the same-subject exports from three other tools and searched each file for the strings former, previous and name_history.
| Export | Date | Hits | Where the history lives |
|---|---|---|---|
| OSINTsearch richard (547 profiles) | 2026-09-05 | former_usernames on the osu row; name_history on NameMC |
Normalized column on every row, raw block per row, identity block |
| fingerprint.to richard | 2026-08-26 | R6 extras.name_history with two entries, changed 2023-06-12 and 2023-06-15; Osu extras.former_usernames thegame98 |
Per-platform extras object, key name varies by module |
| fingerprint.to cia | 2026-09-03 | R6 name_history with three entries timestamped from 2023-08-24 to 2026-01-12; Bluesky former_usernames with two entries |
Per-platform extras object |
| fingerprint.to meme | 2026-09-03 | Osu former_usernames "African Anger" |
Per-platform extras object |
| osint.industries richard (400 rows) | 2026-08-26 | 0 for former, 0 for name_history, 6 for previous |
A "Previously Used Identifiers" list inside the Rainbow Six Siege (TrackerGG) card body: two entries, both dated 2023 |
| Revealer richard_report_2026-09-03.json | 2026-09-03 | 0 for all three strings | No former-username field in the export |
The honest reading. fingerprint.to has the same osu signal, and on Rainbow Six and Bluesky it returned timestamped history OSINTsearch did not. Its R6 cia entry, three names between 2023-08-24 and 2026-01-12, is the longest name history in any file we opened. osint.industries carries the R6 rename too, as a display string inside one module's card. Our own Revealer export has nothing, and that is a gap we should close.
What none of the other exports we opened do is normalize. fingerprint.to's key is former_usernames on osu and Bluesky and name_history on R6, inside an extras object whose shape changes per module. osint.industries uses a human label in a card body. OSINTsearch puts former_usernames on every row at the same path, keeps the raw key next to it, and adds the CSV count and truncated columns. For one handle that is a convenience. For a batch of fifty it is the difference between a filter and a script.
Workflow: find, verify, pivot, document
1. Find
Run the current handle. In the JSON, filter platforms[] where former_usernames is non-null, then search the file for name_history, former_names, previous_usernames and screenname to catch rows where the column is empty but the raw block is not (the /id/meme Steam row). Read identity.username_variants last: it catches ENS names, archive.org member names and the TikTok backup-handle pattern the row-level column misses.
In the CSV, sort by former_usernames_count descending and check former_usernames_truncated.
2. Verify
Open the platform page. Steam shows previous names on the public profile; osu shows them on the user page; on NameMC confirm the UUID in the export matches the page. For any entry you cannot see live (the Instagram mollyhalecia entry in our set), record it as reported by the tool and unverified, and look for an archived copy.
Check the account is the account. A former name on osu user 2525267 is evidence about that account and says nothing about richard on Twitter, who is almost certainly someone else. Dictionary handles resolve to many people; these runs are a coverage test, not a person.
3. Pivot
Run the old handle as a new username search and through breach lookup. Search archive.org for the old profile URL. Search the old handle in quotes on platforms where the current handle is live. Two accounts sharing a former name and a join year are a lead.
OSINTsearch deep search (depths 1 to 4 on Pro, per /pricing) follows usernames found in results automatically, and the CSV records seed_username, seed_depth, seed_kind and seed_evidence so you can see which rows came from which pivot.
4. Document
Record both handles, the platform, the user ID, the source field, the platform timestamp if any, the retrieval date, and whether you verified it live. The export carries scraped_at per row and exported_at in meta; keep the file. The tool's own standard, from its Instagram case study: "Preserve the result with its retrieval date, source fields and any limits on the observation."
Caution: what a former username does not prove
A former username is a lead about an account, not a finding about a person.
- Sold and reassigned handles. The name GammaCIA attached to a 2004 Steam account that renamed in 2010 tells you what that account was called. It does not tell you who typed the rename or whether the account changed hands since.
- Coincidence on common names. Two accounts that both used to be called "Richard" share nothing. A shared former name is interesting only when it is distinctive.
- Safety renames. If the pattern looks like a person shaking off harassment, the ethical answer is to stop. The technique does not know the difference; you have to.
- Tool-derived entries. Where a former name appears only in the normalized column and not in the raw source payload, treat it as unverified until you have seen it on the platform or in an archive.
- Account continuity is not identity. OSINTsearch's own wording: "A matching account ID can support continuity between records; it does not establish who operated the account or whether the allegations are true." Write that sentence into the report template.
What we looked at
Six OSINTsearch username subjects run on 2026-09-05: richard (547 profiles found), meme (446), cia (329), davidbombal (59), srhoe (37 on the 09:24 run, 31 on the 21:20 and 21:24 runs), deadcatx3 (21). Schema 2 and 3 JSON exports opened in Python and searched key by key for former, previous and name_history; the 2026-09-07 investigation CSV for column names. Same-subject fingerprint.to exports, the osint.industries richard export from 2026-08-26 and our own richard_report_2026-09-03.json, searched for the same strings. Every former name printed here is a handle, never resolved to a person; davidbombal is a public educator and is named as such.
Frequently asked questions
How do I find old usernames for an account? Start with the platforms that publish history: Steam, osu, NameMC, Rainbow Six trackers, archive.org member screennames. A tool that exports the raw source payload, as OSINTsearch does, gets those in one file; then verify each live.
Does OSINTsearch find former usernames on every platform? No, and it does not claim to. It returns them "where sources still provide them". On 2026-09-05 that meant Steam, osu, Instagram, NameMC, archive.org, TikTok and ENS. Most platforms do not expose renames and return nothing.
Is fingerprint.to better than OSINTsearch for username history?
On the raw signal they are close, and on Rainbow Six and Bluesky fingerprint.to returned timestamped history OSINTsearch did not. On usability OSINTsearch wins: a former_usernames column on every row, raw keys preserved, a sourced variants block, and count and truncated columns in CSV.
Does the Revealer export include previous usernames?
Not in the richard_report_2026-09-03.json we opened: zero hits for former, previous and name_history. It carries breach and stealer-log rows the others do not, but no rename data.
Does a shared former username prove two accounts belong to the same person? No. A distinctive former name shared by two accounts with matching join years, avatars or bios is a strong lead. A common one, or one on a sold handle, proves nothing on its own.
What should I record when I find a former handle? Current handle, former handle, platform, user ID, the export field it came from, the platform timestamp if any, the retrieval date, and whether you confirmed it on the live page or an archived copy.