# Which Websites Are Known to Frequently Rate Limit in Holehe? A Complete Module Reference

> Discover which websites frequently rate limit in Holehe. Our guide identifies services with HTTP 429 responses, helping you navigate email-to-account discovery.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: api-reference
- Published: 2026-08-28

---

**Holehe marks 31 services with frequent rate‑limit behavior via a "Frequent Rate Limit" column in its README module table, signaling which sites most often return HTTP 429 responses during email‑to‑account discovery probes.**

The open‑source **Holehe** tool by **megadose/holehe** checks if an email address is registered on hundreds of websites through password‑recovery endpoints. Some services aggressively throttle such requests. This article identifies every site flagged in the source code as prone to rate limiting, explains how Holehe surfaces throttling in results, and shows developers how to detect and handle these limits programmatically.

## Where Holehe Documents Rate‑Limited Services

The definitive source is **[`README.md`](https://github.com/megadose/holehe/blob/main/README.md)** at the repository root, specifically around [line 120](https://github.com/megadose/holehe/blob/master/README.md#L120), where the module table includes a "Frequent Rate Limit" column. A **✔** symbol in this column indicates that maintainers have observed consistent HTTP 429 "Too Many Requests" responses from that service.

Individual module implementations reside in **`holehe/modules/`** (e.g., [`modules/social_media/instagram.py`](https://github.com/megadose/holehe/blob/main/modules/social_media/instagram.py)), and the orchestration logic in **[`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py)** aggregates results including a boolean `rateLimit` flag.

## Full List of Frequently Rate‑Limited Sites in Holehe

The following 31 services carry the frequent rate‑limit marker according to megadose/holehe source documentation:

- anydo
- blablacar
- blackworldforum
- blip
- buymeacoffee
- clashfarmer
- codecademy
- cracked_to
- crevado
- deliveroo
- demonforums
- dominosfr
- ebay
- garmin
- google
- imgur
- instagram
- komoot
- office365
- patreon
- replit
- sevencups
- smule
- spotify
- taringa
- tunefind
- venmo
- wattpad
- xnxx
- yahoo
- zoho

Most of these are high‑traffic platforms with sophisticated bot detection. Services like **Google**, **Instagram**, **Spotify**, and **eBay** implement aggressive rate limiting because their password‑recovery endpoints are common targets for abuse.

## How Holehe Detects and Reports Rate Limits

Each module in **`holehe/modules/`** returns a dictionary with consistent keys. When a service responds with HTTP 429 or equivalent throttling indicators, the module sets `"rateLimit": True` in its result.

### Python API Example

```python
import httpx
import trio
from holehe.modules.social_media.instagram import instagram

async def check_instagram(email: str):
    """
    Probe Instagram for account existence; detect rate‑limit responses.
    """
    async with httpx.AsyncClient() as client:
        results = []
        await instagram(email, client, results)
        # results[0] contains: {

        #   "name": "instagram",

        #   "domain": "instagram.com",

        #   "method": "register",

        #   "frequent_rate_limit": True,

        #   "rateLimit": True/False,

        #   "exists": True/False,

        #   "emailrecovery": ...,

        #   "phoneNumber": ...,

        #   "others": ...

        # }

        result = results[0]
        
        if result.get("rateLimit"):
            print(f"Instagram rate‑limited the request for {email}")
        elif result.get("exists"):
            print(f"Account found: {email}")
        else:
            print(f"No account detected or ambiguous response")

trio.run(check_instagram, "example@example.com")

```

The `frequent_rate_limit` field in the module's metadata (derived from the README table) warns that this service often throttles, while `rateLimit` in the actual result indicates whether the current request was throttled.

### CLI Detection

```bash

# Run Holehe and filter for rate‑limit indicators

holehe example@example.com --only-used | jq '.[] | select(.rateLimit == true) | .name'

# Or grep raw JSON output

holehe example@example.com 2>/dev/null | grep -B2 '"rateLimit": true'

```

## Handling Rate Limits in Bulk Operations

When scanning multiple emails or running continuous monitoring, expect throttling from the flagged services. Strategies include:

1. **IP rotation** – Use residential proxies or VPN endpoints; many flagged sites (Google, Instagram, eBay) track IP‑level request velocity.

2. **Request spacing** – Insert delays between probes to the same domain; Holehe has no built‑in delay, so wrap calls in `asyncio.sleep()` or `trio.sleep()`.

3. **Prioritization** – Skip `frequent_rate_limit=True` modules when speed matters, or process them in isolated batches with dedicated IP pools.

4. **Retry logic** – Check `rateLimit: True` and queue the email/domain pair for reprocessing after a cooldown period.

## Key Files for Rate‑Limit Behavior

| File Path | Purpose |
|-----------|---------|
| [`README.md`](https://github.com/megadose/holehe/blob/main/README.md#L120)+) | Master module table with "Frequent Rate Limit" column |
| [`holehe/modules/social_media/instagram.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/instagram.py) | Example of frequently rate‑limited module |
| [`holehe/modules/transport/blablacar.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/transport/blablacar.py) | Another flagged service implementation |
| [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) | Orchestrates execution, aggregates `rateLimit` flags |

## Summary

- **31 services** are documented as frequently rate‑limited in Holehe's README, marked with ✔ in the "Frequent Rate Limit" column.
- High‑value targets like **Google**, **Instagram**, **Spotify**, **eBay**, and **Yahoo** aggressively throttle password‑recovery probes.
- Holehe surfaces throttling via the **`rateLimit`** boolean field in module results.
- The **`frequent_rate_limit`** metadata flag warns users before execution which modules commonly trigger HTTP 429 responses.
- Developers should implement **IP rotation**, **request delays**, and **retry queues** when targeting these services at scale.

## Frequently Asked Questions

### How can I tell if a Holehe module was rate‑limited during my scan?

Check the `rateLimit` field in the result dictionary. If `true`, the service returned HTTP 429 or equivalent throttling response. The CLI outputs JSON with this field; use `jq` or `grep` to filter. Each module in `holehe/modules/` consistently includes this key.

### Does Holehe automatically retry when rate‑limited?

No. Holehe does not implement automatic retry logic or backoff delays. The tool reports throttling via `rateLimit: True` and leaves retry strategy to the caller. You must implement your own retry loops with appropriate delays and IP rotation.

### Which Holehe modules are most likely to fail due to rate limits?

According to the source README, modules for **Google**, **Instagram**, **eBay**, **Spotify**, **Yahoo**, **Office365**, **Patreon**, and **Garmin** are among the most frequently throttled. These are large platforms with advanced bot detection protecting their password‑recovery flows.

### Can I exclude frequently rate‑limited modules from a Holehe scan?

Yes. Use the `--only-used` flag with service selection, or filter modules programmatically by checking the `frequent_rate_limit` metadata before execution. The Python API lets you import specific modules rather than running the full discovery suite.