Detection Methods Used by Holehe Modules: A Complete Guide to Email OSINT Techniques

Holehe employs four distinct detection methods—register, login, password recovery, and other—to verify whether an email address is registered across hundreds of online services, with each module explicitly declaring its technique via a method variable defined in the source code.

Holehe is an open-source email OSINT (Open Source Intelligence) tool maintained by megadose/holehe that checks for account existence on various platforms without alerting the target. Understanding the detection methods used by holehe modules is essential for interpreting results and developing custom modules. Each service module located in holehe/modules/ implements one of four specific techniques to enumerate accounts while minimizing detection risk.

The Four Detection Methods Defined

Every module in the Holehe repository declares a detection strategy by setting a method variable within its main async function. These methods determine how the module interacts with the target service's endpoints to confirm account existence.

register

The register method queries email availability endpoints or registration APIs to determine if an address is already claimed. This technique checks if the service reports the email as "already taken" during the signup process.

In holehe/modules/social_media/twitter.py, the module uses this approach:

async def twitter(email, client, out):
    name = "twitter"
    domain = "twitter.com"
    method = "register"
    # Queries https://api.twitter.com/i/users/email_available.json

This method is passive and typically only requires a single GET request to an endpoint that returns availability status without triggering authentication challenges or rate limits on login endpoints.

login

The login method simulates partial login flows or checks username validation during authentication sequences. The module submits the email to login endpoints and analyzes error messages or response codes to confirm account existence.

The Snapchat module in holehe/modules/social_media/snapchat.py demonstrates this technique by initiating the login flow and interpreting the server's response patterns to determine if the email is associated with an active account.

password recovery

The password recovery method exploits password reset functionalities by submitting the target email to recovery endpoints. If the server responds with "password reset email sent" or similar confirmation rather than "email not found," the module confirms the account exists.

The Odnoklassniki implementation in holehe/modules/social_media/odnoklassniki.py uses this approach against the platform's password recovery page, parsing the HTML response to detect whether the email is recognized by the system.

other

The other method serves as a catch-all category for custom detection logic that does not fit the standard three patterns. Currently, only the Office365 module in holehe/modules/software/office365.py uses this classification, implementing specialized logic to check Microsoft tenant configurations and email validity through unique API endpoints that differ from standard registration or login flows.

Implementation in the Core Engine

The detection method metadata flows through the entire execution pipeline. Each module appends a dictionary to the out list containing the method field alongside existence status. The core() function in holehe/core.py orchestrates these checks and aggregates results.

Here is how modules structure their output:

# Excerpt pattern from holehe/modules/

out.append({
    "name": name,
    "domain": domain,
    "method": method,  # "register", "login", "password recovery", or "other"

    "exists": exists,  # True, False, or None

    "emailrecovery": None,
    "phoneNumber": None,
    "others": None
})

Practical Usage and Output Examples

When running Holehe via CLI or Python API, the detection method appears in the results, allowing investigators to understand how each verification was performed.

Command Line Usage

# Run from repository root

python -m holehe -e target@example.com

Programmatic API Access

import asyncio
from holehe.core import core

async def enumerate_email(email):
    results = await core(email)
    for result in results:
        service = result['name']
        exists = result['exists']
        method = result['method']
        print(f"{service}: exists={exists}, method={method}")

# Execute check

asyncio.run(enumerate_email("user@example.com"))

Sample Output Analysis

twitter: exists=True, method=register
snapchat: exists=False, method=login
odnoklassniki: exists=True, method=password recovery
office365: exists=True, method=other

This output reveals that Twitter was checked via registration API availability, Snapchat through login flow analysis, Odnoklassniki via password reset enumeration, and Office365 through custom tenant verification logic.

Summary

• Four detection methods categorize all verification techniques in Holehe: register, login, password recovery, and other.
• Source file locations: Social media modules reside in holehe/modules/social_media/, software services in holehe/modules/software/, with the core engine at holehe/core.py.
• Implementation: Each module defines a method variable (e.g., method = "register") in its main async function to specify the detection strategy.
• Result aggregation: The core engine collects method metadata alongside existence status in the results dictionary, enabling transparent reporting of verification techniques.

Frequently Asked Questions

What are the detection methods used by holehe modules?

Holehe modules use four detection methods: register (checking email availability during signup), login (analyzing authentication responses), password recovery (exploiting password reset endpoints), and other (custom implementations for complex services like Office365). Each module explicitly declares its method via a string variable named method.

How does the register detection method work in holehe?

The register method queries registration or email availability endpoints to see if an address is already taken. For example, in holehe/modules/social_media/twitter.py, the module sends requests to Twitter's email availability API; if the response indicates the email is unavailable for registration, the module reports that an account exists.

Where is the detection method defined in a holehe module?

The detection method is defined inside the main async function of each module as a local variable called method. For instance, in holehe/modules/social_media/snapchat.py, the line method = "login" declares that this module uses login flow analysis. This variable is then included in the output dictionary that the module appends to the results list.

Why does the Office365 module use the other detection method?

The Office365 module in holehe/modules/software/office365.py uses the other method because it implements specialized logic for Microsoft's complex authentication ecosystem, including tenant discovery and Active Directory enumeration. This approach does not fit the standard register, login, or password recovery patterns used by most social media modules, requiring a custom category designation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}