How the Holehe Instagram Module Detects Account Existence: CSRF Extraction & Registration Emulation

The Holehe Instagram module detects account existence by extracting a CSRF token from Instagram's sign-up page, submitting a mock registration attempt with the target email, and parsing specific error codes like email_is_taken returned by the web_create_ajax/attempt endpoint.

The Instagram detector in the Holehe OSINT toolkit programmatically determines whether an email address is linked to an existing Instagram account without requiring authentication credentials. By emulating the browser-based registration flow at instagram.com, the module leverages Instagram's own validation responses to infer account ownership through error message analysis.

How the Detection Algorithm Works

The detection logic resides in holehe/modules/social_media/instagram.py and operates by mimicking a legitimate user's attempt to create a new account. Rather than authenticating, the module exploits the validation responses returned during the account creation process to determine if an email is already registered.

Step 1 – Extracting the CSRF Token from the Sign-Up Page

The module first issues a GET request to https://www.instagram.com/accounts/emailsignup/ using a realistic Chrome User-Agent from holehe/localuseragent.py. Instagram embeds a csrf_token within the HTML source as part of a JSON configuration object. The module extracts this token at line 22 using precise string splitting:

token = freq.text.split('{\\"config\\":{\\"csrf_token\\":\\"')[1].split('\\"')[0]

This token is mandatory for all subsequent state-changing requests to Instagram's API and is stored for the next phase of the check.

Step 2 – Crafting the Registration Attempt Payload

The module constructs a POST payload containing a randomly generated username (6-30 characters) and the target email address. The previously extracted CSRF token is injected into the request headers as x-csrftoken. The request targets https://www.instagram.com/api/v1/web/accounts/web_create_ajax/attempt/ (lines 40-42), which is Instagram's internal endpoint for validating registration fields prior to final account creation.

Step 3 – Analyzing Error Responses for Account Existence

Instagram returns a JSON response containing a top-level status field and an optional errors object. The module interprets these patterns to determine account existence:

• email_is_taken (lines 46-48): Indicates the email is already registered to an existing account
• email_sharing_limit (lines 53-58): Indicates the email is associated with an account that has reached sharing limits

When either error appears in the response payload, the module sets exists: True. If the status field equals "fail" without specific email errors, the module sets rateLimit: True and treats the check as inconclusive rather than confirming non-existence.

Rate Limiting and Anti-Detection Measures

The module declares frequent_rate_limit = True at line 9, signaling that Instagram aggressively throttles validation requests. If the initial CSRF token request fails, the function immediately returns a rate-limit result (lines 24-29) without attempting the registration check. This early exit reduces unnecessary network traffic and minimizes the detection footprint when Instagram blocks automated access.

Complete Implementation Example

You can invoke the Instagram detector directly using httpx or through Holehe's orchestration system:

import asyncio
import httpx
from holehe.modules.social_media import instagram

async def check_instagram(email: str):
    async with httpx.AsyncClient(timeout=10) as client:
        results = []
        await instagram(email, client, results)
        return results[0]

# Execute the check

info = asyncio.run(check_instagram("target@example.com"))
print(info)

# Output: {'name': 'instagram', 'domain': 'instagram.com', 

#          'method': 'register', 'frequent_rate_limit': True, 

#          'rateLimit': False, 'exists': True, 'emailrecovery': None, ...}

For integration with the full Holehe scanning suite:

import asyncio
from holehe.core import core

async def run_check(email):
    async with httpx.AsyncClient() as client:
        out = []
        await core(email, client, out)
        return [r for r in out if r["name"] == "instagram"]

instagram_result = asyncio.run(run_check("test@example.com"))

Summary

• The Instagram module detects account existence by emulating the registration flow at instagram.com/accounts/emailsignup/ without requiring login credentials.
• It extracts a CSRF token from the page source using string splitting logic at line 22 to authenticate subsequent API requests.
• The module POSTs to /api/v1/web/accounts/web_create_ajax/attempt/ and analyzes error codes to determine if an email is registered.
• Specific error strings (email_is_taken, email_sharing_limit) confirm an existing account association according to lines 46-48 and 53-58.
• Aggressive rate limiting is handled through the frequent_rate_limit flag and immediate exit if CSRF token extraction fails.

Frequently Asked Questions

Does the Instagram module require a logged-in session to check account existence?

No, the module operates without authentication. It leverages Instagram's public registration endpoint, which returns validation errors for existing emails during the account creation process, eliminating the need for valid credentials or session cookies.

What specific error codes indicate an email is already registered on Instagram?

According to the source code in holehe/modules/social_media/instagram.py, the module detects two specific error indicators: email_is_taken (evaluated at lines 46-48) and email_sharing_limit (evaluated at lines 53-58). The presence of either error in the JSON response confirms the email belongs to an existing Instagram account.

How does the module handle Instagram's rate limiting?

The module sets frequent_rate_limit = True at line 9 to signal aggressive throttling behavior. If the initial CSRF token request fails, it immediately returns rateLimit: True (lines 24-29). Additionally, any response with a top-level status value of "fail" triggers rate limit protection rather than marking the email as available.

Can Instagram detect and block this checking method?

While the module uses realistic User-Agent strings from holehe/localuseragent.py and proper HTTP headers, rapid sequential requests from the same IP address may trigger Instagram's anti-automation defenses. The module mitigates detection risks by implementing early exit logic when tokens cannot be retrieved and by flagging rate-limited responses appropriately.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}