Conversation
TryHackMe: the /api/user/exist/ probe endpoint now redirects to the not-found page for every username, so every lookup was a false result. Detection now checks the profile page title, which is the site default for missing users and personalized for existing ones. Hashnode: profile pages return HTTP 200 for nonexistent users, so status_code detection produced false positives. Switched to message detection on the "User not found" page title. The previous username_claimed (blue) no longer exists; replaced with an active user. GeeksforGeeks: auth.geeksforgeeks.org profile URLs are gone; moved to www.geeksforgeeks.org/user/{} and updated the error message to match the new missing-user page title. All three pass test_validate_targets (false positive and false negative checks) and the manifest schema tests. Ref sherlock-project#2547 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0169CZZQwQdKmRe4sNXobKix
…ailykos, Chatujme.cz, Rarible
Discord.bio, ReverbNation, interpals: status_code now cleanly
distinguishes missing (404) from existing (200) profiles; the old
message-based errorMsg no longer matches current page content, so
these were always falling through to Claimed.
dailykos: the urlProbe nickname-availability endpoint
(check_nickname) is dead and now 404s unconditionally. Dropped it in
favor of the main profile URL, which cleanly 404s for missing users.
Chatujme.cz: the site's Czech "profile does not exist" copy changed
from "Neexistující profil" to "Profil {user} nelze zobrazit" — updated
the error message to match the stable "nelze zobrazit" substring.
Rarible: the API now soft-404s (HTTP 200 with an HTML "Page Not Found"
body) for missing users instead of a real 404, while existing users
still get the original JSON payload. Switched from status_code to
message detection on that HTML title.
All six verified live across two rounds each (random vs. known
username) and pass test_validate_targets (false positive + false
negative) plus the manifest schema tests.
Ref sherlock-project#2547
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0169CZZQwQdKmRe4sNXobKix
MRashad01
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes detection for nine sites on the false positive exclusion list, per the contribution call in #2547. Each fix is a live-verified change to
sherlock_project/resources/data.json— no logic changes.urlProbeAPI endpoint now redirects to not-found for every usernamestatus_codealways false-positivedmessageon the "User not found" title; refreshed deadusername_claimedauth.geeksforgeeks.orgprofile URL is gonewww.geeksforgeeks.org/user/{}, update error titlemessageerrorMsg no longer matches current error pagestatus_code(404 vs 200 is clean)messageerrorMsgstatus_code(404 vs 200 is clean)messageerrorMsgstatus_code(404 vs 200 is clean)urlProbenickname-availability endpoint is dead (404s unconditionally)urlProbe, use main profile URL withstatus_codeerrorMsgto the new stable substring (nelze zobrazit)status_code→messageon the HTML titleTesting
For every site: verified live across 2+ rounds (randomly generated username vs. a real known username), then ran the project's own validation suite:
18/18 passed (false positive + false negative checks for all 9 sites).
pytest tests/test_manifest.pyalso passes (schema valid).Note on scope
I triaged the full exclusion list (~46 sites). Most of the remainder are genuinely hard — Cloudflare/WAF blocking (Giphy, hunting, phpRU), identical HEAD/GET responses regardless of username (Bandcamp, Weblate, Scribd, and others), or JS-rendered SPAs with no distinguishing server response. I didn't want to guess at fixes I couldn't verify, so this PR only includes the sites where I found a reliable, reproducible signal. Happy to keep working through the rest in follow-ups if useful.
🤖 Generated with Claude Code
https://claude.ai/code/session_0169CZZQwQdKmRe4sNXobKix