The Detection Methods Used by Holehe Modules: Register, Login, Password Recovery, and Other

Holehe modules determine email account existence using four distinct detection methods—register, login, password recovery, and other—with each technique defined in the method variable of individual service files.

Holehe is an open-source intelligence (OSINT) tool maintained by megadose that verifies whether an email address is associated with accounts across hundreds of online platforms. Each service implementation within holehe/modules/ employs specific detection methods to probe for account existence without requiring valid credentials, returning the technique used alongside the results.

The Four Detection Methods in Holehe Source Code

Contrary to the common assumption of three methods, the codebase explicitly defines four distinct values for the method parameter. These categorize how each module interacts with target services to verify email registration status.

Register Method

The register method queries email-availability or registration-validation endpoints to determine if an address is already claimed by an existing user. This approach checks if the service responds with "email already taken" errors during simulated signup flows.

In holehe/modules/social_media/twitter.py, the module implements this method by calling Twitter's email availability API:

async def twitter(email, client, out):
    name = "twitter"
    domain = "twitter.com"
    method = "register"
    # Module queries https://api.twitter.com/i/users/email_available.json

This technique is passive and typically leaves no trace on the target account, as it only checks availability without creating sessions.

Login Method

The login method attempts partial or complete authentication flows using the target email address. Rather than completing sign-in, the module analyzes error messages or response codes to infer whether the account exists.

The Snapchat module in holehe/modules/social_media/snapchat.py demonstrates this approach by initiating the login flow and parsing server responses to detect valid accounts. This method may generate login attempt notifications on some platforms, making it more invasive than registration checks.

Password Recovery Method

The password recovery method triggers forgot-password or account-recovery workflows to test email recognition. Services typically reveal account existence when processing reset requests differently for registered versus unrecognized addresses.

For example, holehe/modules/social_media/odnoklassniki.py utilizes Odnoklassniki's password recovery endpoint to verify account linkage. The module submits the email to the recovery form and interprets whether the server recognizes the address as belonging to an active account.

Other Method

The other category encompasses custom detection logic that does not fit the three standard patterns. Currently, only the Office 365 module in holehe/modules/software/office365.py uses this classification, implementing domain-specific validation that differs from standard registration or login probes.

How Detection Methods Are Implemented

Each Holehe module declares its detection strategy through a local method variable defined near the function signature. This variable is later included in the result dictionary returned to the core engine.

In holehe/core.py, the orchestrator collects results from all modules, with each entry containing the method field alongside name, domain, exists, and other metadata. This allows the reporting layer to distinguish between a Twitter check that used registration APIs versus a Snapchat check that attempted login flows.

Practical Usage and Interpreting Results

When running Holehe from the command line, the output includes the detection method used for each service:

python -m holehe -e user@example.com

Sample output structure:

[+] twitter.com: exists=True (method: register)
[-] snapchat.com: exists=False (method: login)
[+] odnoklassniki.ru: exists=True (method: password recovery)
[-] office365.com: exists=False (method: other)

Programmatically, you can access the method field when using Holehe as a Python library:

import asyncio
from holehe.core import core

async def analyze_email(email):
    results = await core(email)
    for result in results:
        service = result['name']
        exists = result['exists']
        method = result['method']
        print(f"{service}: {exists} (detected via {method})")

asyncio.run(analyze_email("target@example.com"))

Summary

• Holehe modules use four distinct detection methods: register, login, password recovery, and other.
• The method variable in each module file (e.g., twitter.py, snapchat.py) declares which technique the module employs.
• register checks email availability APIs, login attempts authentication flows, and password recovery exploits reset mechanisms.
• Results aggregated in holehe/core.py include the detection method, allowing users to understand how each account existence determination was made.

Frequently Asked Questions

What are the three main detection methods used by Holehe modules?

While Holehe categorizes techniques into four distinct methods, the three primary detection strategies are register, login, and password recovery. The fourth method, other, serves as a fallback for custom implementations like the Office 365 module that do not fit standard patterns.

How does the register detection method work in Holehe?

The register method queries registration endpoints or email-availability APIs to check if an address is already claimed. For example, the Twitter module uses this method to call https://api.twitter.com/i/users/email_available.json, interpreting "already taken" responses as confirmation of account existence.

Where is the detection method defined in a Holehe module?

Each module defines its detection method through a method variable assigned near the top of the async function. In holehe/modules/social_media/twitter.py, you will find method = "register" declared immediately after the name and domain variables, before any network requests occur.

Can I filter Holehe results by detection method?

Currently, Holehe does not provide a built-in CLI flag to filter by detection method. However, when using the Python API as shown in holehe/core.py, you can programmatically filter the results list by checking result['method'] == 'register' or your desired technique before processing the output.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}