What Is the Login Check Detection Strategy in Holehe? A Deep Dive into Email OSINT

Holehe's Login Check detection strategy probes a service's authentication endpoint with a target email address to determine if an account exists, without actually logging in.

This OSINT tool analyzes the HTTP response patterns—status codes, error messages, and redirects—to verify whether an email is registered on a platform. The strategy is implemented centrally in holehe/instruments.py and reused across dozens of service-specific modules in the megadose/holehe repository.

How the Login Check Strategy Works

The Login Check strategy mimics a legitimate login attempt using a dummy password. Instead of authenticating, Holehe examines how the service responds to a known email versus an unknown one.

Here is the detection dictionary structure defined in each module:

{
    "type": "Login Check",
    "method": "post",
    "url": "<service-specific login endpoint>",
    "payload": {"email": "<target>", "password": "random_string"},
    "valid_status": [200, 302],
    "invalid_markers": ["invalid", "not found", "unknown"]
}

Holehe interprets the response according to two scenarios:

• Found: The service recognizes the email but rejects the password (e.g., "incorrect password", "wrong credentials")
• Not Found: The service indicates the email does not exist (e.g., "user not found", "account doesn't exist")

Core Implementation Files

holehe/instruments.py

The login_check helper function in holehe/instruments.py implements the reusable logic. This function:

1. Builds the HTTP request from the module's detection dictionary
2. Sends the request to the authentication endpoint
3. Parses the response for status codes and error markers
4. Returns a boolean indicating email existence

holehe/core.py

The orchestration happens in holehe/core.py. This file:

• Iterates over all enabled modules during a scan
• Loads each module's detection definition
• Invokes the generic login_check helper with the appropriate parameters

Example Module: holehe/modules/mails/google.py

Service-specific modules define their own Login Check configurations. The Google Mail module uses:

detection = {
    "type": "Login Check",
    "method": "post",
    "url": "https://accounts.google.com/ServiceLoginAuth",
    "payload": {"Email": "<email>", "Passwd": "random"},
    "valid_status": [200, 302],
    "invalid_markers": ["Bad login", "accountNotFound"],
}

Practical Usage Examples

Command Line

# Check a single email address across all supported services

holehe -l alice@example.com

# Output shows which services recognize the email

Programmatic Python

# Using Holehe's Login Check strategy programmatically

from holehe.core import Holehe

scanner = Holehe()
results = scanner.check("alice@example.com")
print(results)

# → {"gmail": "found", "twitter": "not found", "github": "found", ...}

Response Parsing Logic

The Login Check strategy relies on precise response analysis. According to the holehe source code, the login_check helper evaluates:

• HTTP status codes: Successful authentication attempts often return 200 or 302
• Error message substrings: Services leak existence information through distinct error strings for "bad password" versus "unknown user"
• Response headers: Location headers in redirects can indicate authentication state

Different services require customized marker lists. For example, Yahoo Mail in holehe/modules/mails/yahoo.py uses different invalid_markers than Google to account for Yahoo's specific error messaging.

Security and Ethical Considerations

The Login Check strategy intentionally uses dummy credentials. This approach:

• Avoids actual authentication or account access
• Minimizes request volume compared to brute-force methods
• Relies on information leakage in authentication error responses

Rate limiting and request delays are implemented in holehe/core.py to reduce impact on target services.

Summary

• Login Check is Holehe's primary detection strategy for email-to-service correlation
• Implementation spans holehe/instruments.py (helper logic) and holehe/core.py (orchestration)
• Each module defines a detection dictionary with endpoint, payload, and response markers
• The strategy differentiates "email exists" from "email unknown" without valid credentials
• Results are returned as boolean found/not-found states across all probed services

Frequently Asked Questions

How does Holehe's Login Check strategy avoid false positives?

The login_check helper in holehe/instruments.py requires multiple validation signals. A match only registers when both the HTTP status code falls within valid_status and the response body contains none of the invalid_markers. Service-specific modules tune these parameters based on observed behavior.

Can services block Holehe's Login Check detection?

Services implementing proper authentication security—returning identical responses for "wrong password" and "unknown user"—defeat this strategy. Holehe modules are community-maintained and updated when services change their error messaging or implement anti-automation measures.

What is the difference between Login Check and other Holehe detection types?

While Login Check probes authentication endpoints directly, Holehe supports additional strategies not detailed in this analysis. The type field in detection dictionaries allows the core scanner to route requests to appropriate handlers in holehe/instruments.py.

Is the Login Check strategy legal for OSINT investigations?

The Login Check sends minimal, non-destructive requests with fabricated credentials. However, legality depends on jurisdiction, target service terms of service, and authorization context. Security researchers typically use Holehe only against services they own or have explicit permission to test.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}