Holehe vs SocialScan vs UhOh365: Complete OSINT Email Checker Comparison

Holehe is the most comprehensive open-source email OSINT tool, offering async execution, 120+ services, and structured JSON output, while SocialScan provides ~30 services with synchronous requests and UhOh365 focuses narrowly on ~15 Microsoft services.

All three are Python-based utilities for discovering email registrations across online platforms. This analysis examines their architectural differences, performance characteristics, and code-level implementations to help security researchers and OSINT investigators choose the right tool.

---

Architecture and Execution Model

Holehe: Async-First Modular Design

Holehe leverages Python 3 async I/O through httpx and trio, enabling concurrent checks across all services. The core orchestration resides in holehe/core.py, which loads and executes modules in parallel.

Each service is encapsulated as an async function under holehe/modules/*. For example, holehe/modules/social_media/twitter.py implements the email registration check with this structure:

# From holehe/modules/social_media/twitter.py (lines 5-37)

async def twitter(email, client, out):
    # Uses Twitter's email availability endpoint

    # Sets frequent_rate_limit=False for this service

    # Returns uniform dict with exists, method, rateLimit fields

The modular approach means adding a new service requires only:

1. Creating a new async function file in the appropriate category folder
2. Updating holehe/modules/__init__.py with the import
3. No modifications to core execution logic

SocialScan: Synchronous Monolithic Script

SocialScan takes a single-file approach. The entire tool operates as one script iterating through a hardcoded service list using the synchronous requests library. Email checks execute sequentially, significantly impacting performance for large target lists.

No abstraction layer separates service implementations—each check embeds directly in the main loop.

UhOh365: Narrow Focus, Similar Sync Pattern

UhOh365 follows SocialScan's pattern but with tighter scope. It targets primarily Microsoft ecosystem services (Outlook, Office365, Azure AD) through uhoh.py using synchronous requests. The ~15 service checks live directly in the central script without modular separation.

---

Service Coverage and Detection Methods

Feature	Holehe	SocialScan	UhOh365
Services	>120	~30	~15
Categories	Social media, mail, CRMs, forums, dating, etc.	Major social networks, some mail	Microsoft/Office365 focus
Detection Methods	register, login, password_recovery	password_recovery, sign-up	password_recovery
Method Metadata	Explicit method field in output	Not tracked	Not tracked

Holehe's detection diversity matters for accuracy. The method field in output distinguishes:

• register — signup endpoint email availability
• login — authentication attempt response analysis
• password_recovery — "forgot password" flow behavior

This granularity aids forensic validation and false-positive assessment.

---

Rate Limit Handling

Holehe: Built-In Throttling Awareness

Every module declares frequent_rate_limit (boolean) and catches exceptions to populate a rateLimit boolean in results. Example from twitter.py:

# Pattern seen in multiple Holehe modules

frequent_rate_limit = False  # Service-specific flag

try:
    # ... request logic ...

except Exception:
    # Rate limit detection

    out.append({
        "name": "twitter",
        "rateLimit": True,
        # ... other fields ...

    })

This allows automated retry strategies and IP rotation decisions without manual 429 inspection.

SocialScan and UhOh365: Manual Handling

Both tools lack explicit rate-limit flags. HTTP 429 responses terminate execution or require manual intervention. No structured output indicates which services triggered throttling.

---

Output Formats and Integration

Holehe: Structured JSON for Automation

Each service returns a uniform dictionary:

{
    "name": "twitter",
    "domain": "twitter.com",
    "method": "register",
    "frequent_rate_limit": False,
    "rateLimit": False,
    "exists": True,
    # ...

}

This enables direct pipeline integration with SIEMs, case management systems, or custom analytical workflows.

SocialScan and UhOh365: Plain Text

Both output human-readable lists requiring regex parsing for automation:

[+] Instagram: exists
[-] Twitter: not found

---

Practical Code Examples

Holehe CLI and Library Usage

Command line execution:

# Install

pip install holehe

# Basic check

holehe test@example.com

# JSON output for processing

holehe test@example.com --json

Async library integration:

import trio
import httpx
from holehe.modules.social_media.twitter import twitter
from holehe.modules.social_media.instagram import instagram

async def check_email(email):
    results = []
    async with httpx.AsyncClient() as client:
        await twitter(email, client, results)
        await instagram(email, client, results)
    return results

# Execute

output = trio.run(check_email, "target@example.com")
print(output)

Source reference: holehe/modules/social_media/twitter.py implements the register method against Twitter's email availability API.

SocialScan Installation and Use

pip install socialscan
socialscan -e test@example.com

The tool lives at megadose/socialscan with single-script implementation in socialscan.py.

UhOh365 Deployment

git clone https://github.com/Raikia/UhOh365
cd UhOh365 && pip install -r requirements.txt
python uhoh.py -e test@example.com

All logic concentrates in uhoh.py with Microsoft-specific request patterns.

---

Performance Characteristics

Scenario	Holehe	SocialScan	UhOh365
Single email, full service list	~2-5 seconds	~30-60 seconds	~10-20 seconds
Large email list throughput	High (async batching)	Low (sequential)	Low (sequential)
Network efficiency	Connection pooling via httpx	New connection per request	New connection per request

Holehe's trio+httpx stack provides connection reuse and concurrent request saturation, while synchronous tools spend most runtime waiting for I/O.

---

Extensibility and Maintenance

Holehe: Community-Ready Contribution Model

The holehe/modules/ structure encourages community modules. New services follow a template:

1. Async function signature: async def servicename(email, client, out)
2. Standard output append to out list
3. Rate limit flag declaration
4. Category-appropriate subfolder placement

Active maintenance through 2024-2026 with 1000+ GitHub stars and regular PyPI releases.

SocialScan and UhOh365: Centralized Maintenance

Adding services requires editing core scripts. SocialScan's ~200 stars and 2022 last release indicate slower evolution. UhOh365 remains niche with minimal fork activity.

---

Summary

• Holehe excels for comprehensive investigations requiring speed, structured output, and broad service coverage—use when you need 120+ services with forensic-grade metadata.

• SocialScan suits quick checks against major platforms when installation simplicity matters more than performance or coverage depth.

• UhOh365 fits Microsoft-centric assessments where Office365/Azure AD enumeration is the primary goal.

Key differentiators favoring Holehe: async architecture in holehe/core.py, modular service implementation under holehe/modules/, explicit rate limit handling per-module, and uniform JSON output enabling automation.

---

Frequently Asked Questions

What makes Holehe faster than SocialScan and UhOh365?

Holehe uses Python's asyncio pattern through trio and httpx to execute all service checks concurrently. While SocialScan and UhOh365 make sequential synchronous requests with requests, Holehe's core.py orchestrates parallel module execution—reducing total runtime from minutes to seconds for full service lists.

Can I use these tools as Python libraries, or only CLI?

Holehe supports both natively. Import any module from holehe.modules and call its async function with an httpx.AsyncClient. SocialScan and UhOh365 are primarily CLI-focused; library usage requires manually extracting functions from their monolithic scripts without guaranteed API stability.

How does Holehe avoid getting rate-limited?

Each module in holehe/modules/ declares a frequent_rate_limit boolean and catches exceptions to set a rateLimit flag in results. This lets you implement backoff strategies, proxy rotation, or priority queuing based on real-time throttling indicators—automation that SocialScan and UhOh365 lack.

Which tool has the most services for email OSINT?

Holehe maintains 120+ services across categories from holehe/modules/social_media/ to holehe/modules/crm/. SocialScan covers approximately 30 major platforms. UhOh365 focuses narrowly on ~15 Microsoft services. The full Holehe list appears in the repository README (lines 19-241).

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}