# Detection Methods Used by Holehe Modules: A Complete Guide to Email OSINT Techniques

> Discover Holehe's four detection methods: register, login, password recovery, and other. Learn how this tool verifies email registrations across hundreds of services for effective OSINT.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: deep-dive
- Published: 2026-08-22

---

**Holehe employs four distinct detection methods—`register`, `login`, `password recovery`, and `other`—to verify whether an email address is registered across hundreds of online services, with each module explicitly declaring its technique via a `method` variable defined in the source code.**

Holehe is an open-source email OSINT (Open Source Intelligence) tool maintained by megadose/holehe that checks for account existence on various platforms without alerting the target. Understanding the detection methods used by holehe modules is essential for interpreting results and developing custom modules. Each service module located in `holehe/modules/` implements one of four specific techniques to enumerate accounts while minimizing detection risk.

## The Four Detection Methods Defined

Every module in the Holehe repository declares a detection strategy by setting a `method` variable within its main async function. These methods determine how the module interacts with the target service's endpoints to confirm account existence.

### register

The **`register`** method queries email availability endpoints or registration APIs to determine if an address is already claimed. This technique checks if the service reports the email as "already taken" during the signup process.

In [`holehe/modules/social_media/twitter.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/twitter.py), the module uses this approach:

```python
async def twitter(email, client, out):
    name = "twitter"
    domain = "twitter.com"
    method = "register"
    # Queries https://api.twitter.com/i/users/email_available.json

```

This method is passive and typically only requires a single GET request to an endpoint that returns availability status without triggering authentication challenges or rate limits on login endpoints.

### login

The **`login`** method simulates partial login flows or checks username validation during authentication sequences. The module submits the email to login endpoints and analyzes error messages or response codes to confirm account existence.

The Snapchat module in [`holehe/modules/social_media/snapchat.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/snapchat.py) demonstrates this technique by initiating the login flow and interpreting the server's response patterns to determine if the email is associated with an active account.

### password recovery

The **`password recovery`** method exploits password reset functionalities by submitting the target email to recovery endpoints. If the server responds with "password reset email sent" or similar confirmation rather than "email not found," the module confirms the account exists.

The Odnoklassniki implementation in [`holehe/modules/social_media/odnoklassniki.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/odnoklassniki.py) uses this approach against the platform's password recovery page, parsing the HTML response to detect whether the email is recognized by the system.

### other

The **`other`** method serves as a catch-all category for custom detection logic that does not fit the standard three patterns. Currently, only the Office365 module in [`holehe/modules/software/office365.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/office365.py) uses this classification, implementing specialized logic to check Microsoft tenant configurations and email validity through unique API endpoints that differ from standard registration or login flows.

## Implementation in the Core Engine

The detection method metadata flows through the entire execution pipeline. Each module appends a dictionary to the `out` list containing the `method` field alongside existence status. The `core()` function in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) orchestrates these checks and aggregates results.

Here is how modules structure their output:

```python

# Excerpt pattern from holehe/modules/

out.append({
    "name": name,
    "domain": domain,
    "method": method,  # "register", "login", "password recovery", or "other"

    "exists": exists,  # True, False, or None

    "emailrecovery": None,
    "phoneNumber": None,
    "others": None
})

```

## Practical Usage and Output Examples

When running Holehe via CLI or Python API, the detection method appears in the results, allowing investigators to understand how each verification was performed.

### Command Line Usage

```bash

# Run from repository root

python -m holehe -e target@example.com

```

### Programmatic API Access

```python
import asyncio
from holehe.core import core

async def enumerate_email(email):
    results = await core(email)
    for result in results:
        service = result['name']
        exists = result['exists']
        method = result['method']
        print(f"{service}: exists={exists}, method={method}")

# Execute check

asyncio.run(enumerate_email("user@example.com"))

```

### Sample Output Analysis

```

twitter: exists=True, method=register
snapchat: exists=False, method=login
odnoklassniki: exists=True, method=password recovery
office365: exists=True, method=other

```

This output reveals that Twitter was checked via registration API availability, Snapchat through login flow analysis, Odnoklassniki via password reset enumeration, and Office365 through custom tenant verification logic.

## Summary

- **Four detection methods** categorize all verification techniques in Holehe: `register`, `login`, `password recovery`, and `other`.
- **Source file locations**: Social media modules reside in `holehe/modules/social_media/`, software services in `holehe/modules/software/`, with the core engine at [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py).
- **Implementation**: Each module defines a `method` variable (e.g., `method = "register"`) in its main async function to specify the detection strategy.
- **Result aggregation**: The core engine collects method metadata alongside existence status in the results dictionary, enabling transparent reporting of verification techniques.

## Frequently Asked Questions

### What are the detection methods used by holehe modules?

Holehe modules use four detection methods: **`register`** (checking email availability during signup), **`login`** (analyzing authentication responses), **`password recovery`** (exploiting password reset endpoints), and **`other`** (custom implementations for complex services like Office365). Each module explicitly declares its method via a string variable named `method`.

### How does the `register` detection method work in holehe?

The `register` method queries registration or email availability endpoints to see if an address is already taken. For example, in [`holehe/modules/social_media/twitter.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/twitter.py), the module sends requests to Twitter's email availability API; if the response indicates the email is unavailable for registration, the module reports that an account exists.

### Where is the detection method defined in a holehe module?

The detection method is defined inside the main async function of each module as a local variable called `method`. For instance, in [`holehe/modules/social_media/snapchat.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/snapchat.py), the line `method = "login"` declares that this module uses login flow analysis. This variable is then included in the output dictionary that the module appends to the results list.

### Why does the Office365 module use the `other` detection method?

The Office365 module in [`holehe/modules/software/office365.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/office365.py) uses the `other` method because it implements specialized logic for Microsoft's complex authentication ecosystem, including tenant discovery and Active Directory enumeration. This approach does not fit the standard `register`, `login`, or `password recovery` patterns used by most social media modules, requiring a custom category designation.