deep-dive

Which Holehe Modules Are Commonly Rate-Limited? Complete 2024 Guide

August 22, 2026 megadose/holehe ↗

In the megadose/holehe repository, 29 modules across categories including social media, shopping, and forums explicitly set frequent_rate_limit = True to warn users that these services aggressively throttle API requests.

Holehe is an open-source OSINT (Open Source Intelligence) tool designed to check if an email address is registered on various platforms. When enumerating accounts across hundreds of services, certain providers implement strict rate limiting that can temporarily block requests. Understanding which holehe modules are commonly rate-limited helps investigators configure appropriate delays and avoid IP bans during reconnaissance operations.

How Rate-Limiting is Flagged in Holehe

According to the source code in megadose/holehe, a module is classified as frequently rate-limited when its implementation contains the boolean assignment frequent_rate_limit = True. This flag serves as a metadata marker that the tool uses to warn users about services with aggressive API throttling.

In holehe/core.py, the central orchestration system checks this flag during module execution. When present, the tool acknowledges that the target service—such as Instagram (holehe/modules/social_media/instagram.py) or Spotify (holehe/modules/music/spotify.py)—will likely return HTTP 429 errors or temporary blocks after minimal request volume.


# Typical module structure showing the rate-limit flag

# Located in holehe/modules/social_media/instagram.py

async def instagram(email, client, out):
    # ... authentication logic ...

    frequent_rate_limit = True  # Flag indicating aggressive throttling

    # ... request implementation ...

Complete List of Rate-Limited Holehe Modules

The current master branch contains 29 modules flagged with frequent_rate_limit = True. These are organized by category below, with direct links to their source implementations.

Social Media Platforms

Social media modules represent the largest group of rate-limited services, reflecting the aggressive anti-bot measures employed by these platforms:

Shopping and Delivery Services

E-commerce platforms frequently implement strict request limits to prevent inventory scraping and automated purchasing:

Music and Entertainment

Streaming services monitor for automated account enumeration attempts:

Forums and Communities

Niche forums often use aggressive rate limiting to prevent spam and scraping:

Other Categories

Handling Rate Limits in Practice

When investigating email addresses across these services, implement request throttling to avoid triggering rate limits. The holehe CLI provides a built-in --delay flag that inserts pauses between requests, which is essential when targeting modules like Yahoo (holehe/modules/mails/yahoo.py) or eBay (holehe/modules/shopping/ebay.py).

Command-Line Usage with Delay


# Add a 3-second delay between requests to avoid throttling

holehe -e target@example.com -m instagram --delay 3

Programmatic Implementation

For scripted investigations, import the Holehe class from holehe/core.py and handle the rateLimit response field:

from holehe.core import Holehe
import time

h = Holehe()

# Check a rate-limited module with custom retry logic

results = h.check("target@example.com", modules=["spotify"])

if results.get("rateLimit"):
    print("Rate limited - backing off for 60 seconds")
    time.sleep(60)
    results = h.check("target@example.com", modules=["spotify"])

The holehe/instruments.py file contains the underlying HTTP request utilities and retry logic that support these operations, though manual delays remain necessary for flagged modules.

Summary

  • 29 modules in the holehe repository set frequent_rate_limit = True, including major platforms like Instagram, Spotify, eBay, and Yahoo.
  • The flag is defined in individual module files (e.g., holehe/modules/social_media/instagram.py) and checked by the core orchestration system.
  • Social media and forum modules represent the most commonly rate-limited categories due to aggressive anti-bot protections.
  • Use the CLI --delay flag or implement programmatic sleep intervals when targeting these services to avoid temporary IP bans.
  • Rate-limited responses return rateLimit: True in the output dictionary, allowing for custom retry logic in automation scripts.

Frequently Asked Questions

What does frequent_rate_limit = True mean in holehe?

This boolean flag, defined in individual module files like holehe/modules/payment/venmo.py, indicates that the target service aggressively limits API requests. When True, users should expect HTTP 429 errors or temporary blocks after few requests and must implement delays between inquiries.

How can I avoid hitting rate limits when using holehe?

Invoke the CLI with the --delay parameter followed by seconds (e.g., --delay 3) to pause between requests, or add time.sleep() intervals in programmatic implementations using holehe/core.py. This is particularly critical for modules like instagram and yahoo that enforce strict throttling.

Which category has the most rate-limited modules?

Social Media contains the highest concentration of flagged modules, with six implementations (instagram, wattpad, taringa, patreon, imgur, crevado) marked as frequently rate-limited. These platforms employ sophisticated bot detection requiring careful request pacing.

Does holehe automatically retry when rate limited?

No, holehe does not implement automatic retry logic for rate-limited requests in the current master branch. While holehe/instruments.py provides HTTP request utilities, the tool returns rateLimit: True in the results dictionary and expects the user to manage backoff strategies manually or via the --delay prevention flag.

Have a question about this repo?

These articles cover the highlights, but your codebase questions are specific. Give your agent direct access to the source. Share this with your agent to get started:

Share the following with your agent to get started:
curl -s "https://instagit.com/install.md"
Works with
Claude Codex Cursor VS Code OpenClaw Any MCP Client

Maintain an open-source project? Get it listed too →