Mr.Holmes is a Python-based OSINT framework that gathers public information about domains, usernames, phone numbers and emails for authorized investigations and defensive research.

Mr.Holmes, maintained by Lucksi (Luca Garofalo) under a GPL-3.0 license, sits in the crowded but productive niche of Python OSINT frameworks. With roughly 4.2k stars on GitHub and an actively maintained badge, it has clearly found an audience among investigators who want a single console that pivots across domains, usernames and phone numbers instead of juggling a dozen browser tabs. The repository describes itself plainly as an information gathering tool whose purpose is to pull together publicly available data, and it backs that claim with an unusually broad feature surface for a hobby-lineage project: dork searching, hypothesis generation, graph and map visualization, PDF reporting and QR-based file transfer.

The core workflow is entity-centric lookup. You hand the tool a username, a domain or a phone number and it queries public sources for matches, presenting consolidated results rather than raw HTTP noise. The README is candid that accuracy is not guaranteed — it states explicitly that the tool can fail and is not 100% accurate — which is a healthy disclaimer that professionals should take seriously. Every OSINT finding should be treated as a lead requiring verification, not as evidence, and Mr.Holmes itself encourages that posture. The newer email-lookup capability extends this by checking whether an email address is associated with specific social platforms and services, and notably it claims to do so without notifying the target — a passive attribute that matters in investigations where tipping off a subject would contaminate the case.

One of the more distinctive modules is the Hypothesis feature introduced in recent versions. Based on a subject's footprint across social media, it generates inferred guesses about hobbies and interests. The README is refreshingly honest in flagging that these hypotheses may not be reliably accurate, and operators should treat them exactly as the name implies: probabilistic leads for a human analyst to confirm or discard. In an authorized context — say, building a subject profile for a sanctioned fraud investigation or a red-team pretext-planning exercise against your own organization — this kind of correlation scaffolding saves hours of manual work, provided the output is verified before it drives decisions.

Dork support is the other headline capability. Mr.Holmes leverages Google dorks for targeted research, and the README documents the ability to constrain searches by media type — video, sound, images — and by date, either a single date such as 1998/01/01 or a range like 1998/01/01-2020/12/31. Date-bounded dorking is genuinely useful for timeline construction in investigations, letting an analyst ask what a target's digital presence looked like during a specific window. As with all dork tooling, operators should keep query volume restrained and scoped; automated dork loops against third-party infrastructure you do not own is both operationally sloppy and a terms-of-service problem, so this belongs in careful, manual, authorized hands.

For domain reconnaissance, the tool integrates a WhoIs lookup backed by an API key from whois.whoisxmlapi.com, enriching registration data beyond what free lookups return. The README also highlights proxy support, advertising that requests can be made anonymous through proxies. From an operational standpoint, proxy routing is a mixed blessing: it protects investigator identity in sensitive cases, but defenders should note that the same capability makes attribution of enumeration traffic harder, and heavy proxy-driven scraping of lookup services is a common abuse signal those services already rate-limit.

Where Mr.Holmes differentiates itself from terminal-only rivals is its reporting layer. Results can be rendered as interactive graphs for relationship mapping and interactive maps built on Leaflet for geolocation visualization of gathered coordinates. Graphs can be exported to PDF in light, dark or high-contrast themes, which is a small but thoughtful touch for delivering findings to non-technical stakeholders. The file-transfer feature generates a QR code to move reports directly to a phone — practical for field investigators who want results on a mobile device without a sync pipeline. Reports can also be encoded and decoded, presumably for light obfuscation during storage or transit.

The presentation layer is a local GUI served with a web stack, which explains the PHP dependency the README mentions for Windows installs. It ships with three visual modes — light, dark and high-contrast — configurable in GUI/Theme/Mode.json, and localization support for English, Italian and French via GUI/Language/Language.json. There is an optional login gate controlled by GUI/Credentials/Login.json and GUI/Credentials/Users.json; when active, the default credentials are Admin/Qwerty123, and any deployment should change these immediately since defaults in a README are effectively public knowledge. Note that the login database is not available on Termux.

Installation is conventional for the category. On Linux or macOS you clone the repository, run sudo bash install.sh, and launch with python3 MrHolmes.py; a venv fallback (python3 -m venv .lib_venv followed by pip3 install -r requirements.txt) is documented for environments where library installation fails. Windows users get Install.cmd and a Win_Launcher.exe in the Launchers folder, while Termux support exists via proot and install_Termux.sh — though the README warns the database feature is unavailable there. The current version line is T.G.D-1.0.4, with a version history hosted on the project's GitHub Pages.

From a defensive perspective, Mr.Holmes is worth studying even if you never run it against a target. Blue teams and security awareness programs can use it defensively to audit their organization's external footprint: run it against your own domains and corporate email patterns to see what an attacker's first hour of recon would surface. Username-enumeration results across social platforms are effectively a shadow-IT and personnel-exposure inventory, and the map view can reveal geotagged content that compliance would rather not exist. The tool's own disclaimer that it is for educational and research purposes only aligns with that usage — footprint auditing, sanctioned investigations and lab work are its legitimate lanes.

Telemetry-wise, the tool leaves a distinctive trail. Its lookups hit public OSINT sites and the whoisxmlapi backend, all observable from the service side as scripted enumeration from one or a handful of IPs, especially when proxies rotate. The whoisxmlapi key ties activity to a registered account. Defenders monitoring their own brand can watch for coordinated username-enumeration bursts against their public profiles and treat them as recon indicators. Within an authorized workflow, that same footprint is a reason to scope engagements contractually and keep query logs for the final report.

Overall, Mr.Holmes earns its stars by being more than a shell of curl calls: the hypothesis engine, date-bounded dorking, graph and map reporting, and multi-language GUI give it a polish level unusual for a personal project. Its weaknesses are equally clear — accuracy is not guaranteed, default GUI credentials ship in the README, and heavy automated use will trip rate limits. For authorized professionals who need a consolidated, report-ready OSINT workbench that runs anywhere from a Kali box to Termux, it is a solid addition to the toolkit, provided every output is independently verified before it informs a decision.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• knockpy for async subdomain enumeration and TLS exposure mapping


• Claude-BugHunter for structured external attack-surface testing with agent skills