Does Holehe Send Notifications to the Target Email Address? A Technical Deep Dive

No, Holehe does not send any email notifications, password-reset links, or verification messages to the target address during its account enumeration process.

Holehe is an open-source OSINT tool developed by megadose that checks whether an email address is registered across hundreds of online services. Unlike tools that trigger actual password-reset flows, Holehe performs silent reconnaissance by querying internal APIs without dispatching messages to the target inbox.

How Holehe Queries Services Without Triggering Email Alerts

The tool operates exclusively through HTTP-based enumeration, probing the “forgot-password” or “email-available” endpoints of supported platforms. Each module constructs a request that asks the service’s backend whether the supplied address exists in their database, parsing the response for status indicators without initiating mail-sending actions.

The HTTP Request Pattern in holehe/core.py

In holehe/core.py, the launch_module function orchestrates the entire process using httpx for asynchronous HTTP requests. The core dispatcher handles the session and executes module-specific logic, but never interfaces with email-sending libraries:

# Core dispatcher – no email is sent here

async def launch_module(module, email, client, out):
    try:
        await module(email, client, out)   # module only queries, never sends mail

    except Exception:
        # error handling – still no outbound email

        ...

As shown in lines 66-73 of holehe/core.py, the implementation limits itself to launching coroutines that perform GET or POST requests to service endpoints. The code explicitly lacks imports for smtplib, sendmail, or any external email-dispatching APIs.

Parsing Existence Signals Without Mail Triggers

Individual modules interpret API responses for strings such as “email already used”, “email_available”, or error codes indicating registration status. The result object constructed by Holehe includes an "emailrecovery" field that remains None, confirming no recovery email was dispatched during the check:

# Result structure shows no recovery email sent

{
    "domain": "instagram.com",
    "exists": True,
    "emailrecovery": None,
    ...
}

This pattern appears consistently across all modules, as evidenced in lines 35-44 of holehe/core.py, where the output dictionary is initialized without any mechanism to capture sent-mail confirmations.

Module Implementation: Instagram and Adobe Examples

Representative modules demonstrate the purely query-based approach. The Instagram module builds a POST request to check email existence against Meta's creation endpoint, while Adobe's module queries their account availability API—neither triggers verification emails.

Instagram Module Analysis

In holehe/modules/social_media/instagram.py, the module submits the target email to Instagram's web creation endpoint and interprets the JSON response:

# Example: Checking Instagram

async def instagram(email, client, out):
    # Build request that asks Instagram if the email exists

    data = {'email': email}
    response = await client.post('https://www.instagram.com/accounts/web_create_ajax/', json=data)
    # Interpret response – no email is sent to the target

    if response.json().get('email') == 'exists':
        out.append({
            "domain": "instagram.com",
            "exists": True,
            "emailrecovery": None,
            ...
        })

The function examines the response body for an exists flag without completing the registration flow or triggering Instagram's email verification system.

Adobe Module Pattern

Similarly, holehe/modules/software/adobe.py queries Adobe's identity services to determine account existence. The module sends HTTP parameters to Adobe's backend API and parses the response for account-linked metadata, never invoking Adobe's password-reset workflow that would generate outbound emails.

Why Holehe Leaves No Email Trail

Holehe's architecture ensures zero email-based side effects through two design constraints:

• No Mail Libraries: The codebase contains no dependencies or imports for smtplib, email.mime, or transactional email services (SendGrid, Mailgun, etc.).
• Read-Only Queries: All network traffic consists of requests that ask services about the email's status rather than requests that use the email to initiate account recovery flows.

The only artifacts generated are outbound HTTP requests from the operator's IP address to the target services' servers. The target email address itself receives no packets, notifications, or log entries indicating it was checked.

Summary

• Holehe never sends emails: The tool lacks any email-sending functionality and does not trigger password-reset or verification messages.
• Pure HTTP enumeration: All checks occur via httpx requests to service APIs, as implemented in holehe/core.py → launch_module.
• Silent reconnaissance: Modules parse API responses for existence indicators (e.g., "email already used") without completing flows that generate notifications.
• No recovery emails: The consistent "emailrecovery": None value in result objects confirms no mail was dispatched during checks.
• Module evidence: Files like holehe/modules/social_media/instagram.py and holehe/modules/software/adobe.py demonstrate query-only behavior against registration endpoints.

Frequently Asked Questions

Does Holehe trigger password reset emails when checking an account?

No. Holehe queries the availability endpoints of services rather than the recovery endpoints. While some tools actively request password resets to confirm account existence via email reception, Holehe parses internal API responses for registration status without initiating mail-sending workflows.

Can the target detect that Holehe is checking their email address?

The target email account itself receives no notifications, logs, or alerts from Holehe's activity. However, the operator's IP address appears in the logs of the services being queried (Instagram, Adobe, etc.). Advanced users monitoring their account security dashboards might see login attempts or validation checks from the operator's IP, but no email-based alerts are generated.

What specific data does Holehe transmit to third-party services?

Each module transmits the target email address via HTTP POST or GET requests to specific endpoints (e.g., instagram.com/accounts/web_create_ajax/). The tool may also send standard browser headers and CSRF tokens required by the target API. It never transmits SMTP commands, mail payloads, or recovery requests that would result in outbound emails to the target.

Is Holehe safe to use for OSINT investigations without alerting the subject?

From an email-notification perspective, yes—Holehe is designed for stealth enumeration. The subject will not receive password-reset emails, verification codes, or security alerts caused by the tool's operation. Investigators should note that aggressive scanning may trigger rate-limiting or IP blocks from the queried services, but the target email address remains unaware of the reconnaissance activity.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}