Which Websites Are Known to Frequently Rate Limit in Holehe? A Complete Module Reference

Holehe marks 31 services with frequent rate‑limit behavior via a "Frequent Rate Limit" column in its README module table, signaling which sites most often return HTTP 429 responses during email‑to‑account discovery probes.

The open‑source Holehe tool by megadose/holehe checks if an email address is registered on hundreds of websites through password‑recovery endpoints. Some services aggressively throttle such requests. This article identifies every site flagged in the source code as prone to rate limiting, explains how Holehe surfaces throttling in results, and shows developers how to detect and handle these limits programmatically.

Where Holehe Documents Rate‑Limited Services

The definitive source is README.md at the repository root, specifically around line 120, where the module table includes a "Frequent Rate Limit" column. A ✔ symbol in this column indicates that maintainers have observed consistent HTTP 429 "Too Many Requests" responses from that service.

Individual module implementations reside in holehe/modules/ (e.g., modules/social_media/instagram.py), and the orchestration logic in holehe/core.py aggregates results including a boolean rateLimit flag.

Full List of Frequently Rate‑Limited Sites in Holehe

The following 31 services carry the frequent rate‑limit marker according to megadose/holehe source documentation:

• anydo
• blablacar
• blackworldforum
• blip
• buymeacoffee
• clashfarmer
• codecademy
• cracked_to
• crevado
• deliveroo
• demonforums
• dominosfr
• ebay
• garmin
• google
• imgur
• instagram
• komoot
• office365
• patreon
• replit
• sevencups
• smule
• spotify
• taringa
• tunefind
• venmo
• wattpad
• xnxx
• yahoo
• zoho

Most of these are high‑traffic platforms with sophisticated bot detection. Services like Google, Instagram, Spotify, and eBay implement aggressive rate limiting because their password‑recovery endpoints are common targets for abuse.

How Holehe Detects and Reports Rate Limits

Each module in holehe/modules/ returns a dictionary with consistent keys. When a service responds with HTTP 429 or equivalent throttling indicators, the module sets "rateLimit": True in its result.

Python API Example

import httpx
import trio
from holehe.modules.social_media.instagram import instagram

async def check_instagram(email: str):
    """
    Probe Instagram for account existence; detect rate‑limit responses.
    """
    async with httpx.AsyncClient() as client:
        results = []
        await instagram(email, client, results)
        # results[0] contains: {

        #   "name": "instagram",

        #   "domain": "instagram.com",

        #   "method": "register",

        #   "frequent_rate_limit": True,

        #   "rateLimit": True/False,

        #   "exists": True/False,

        #   "emailrecovery": ...,

        #   "phoneNumber": ...,

        #   "others": ...

        # }

        result = results[0]
        
        if result.get("rateLimit"):
            print(f"Instagram rate‑limited the request for {email}")
        elif result.get("exists"):
            print(f"Account found: {email}")
        else:
            print(f"No account detected or ambiguous response")

trio.run(check_instagram, "example@example.com")

The frequent_rate_limit field in the module's metadata (derived from the README table) warns that this service often throttles, while rateLimit in the actual result indicates whether the current request was throttled.

CLI Detection

# Run Holehe and filter for rate‑limit indicators

holehe example@example.com --only-used | jq '.[] | select(.rateLimit == true) | .name'

# Or grep raw JSON output

holehe example@example.com 2>/dev/null | grep -B2 '"rateLimit": true'

Handling Rate Limits in Bulk Operations

When scanning multiple emails or running continuous monitoring, expect throttling from the flagged services. Strategies include:

1. IP rotation – Use residential proxies or VPN endpoints; many flagged sites (Google, Instagram, eBay) track IP‑level request velocity.

2. Request spacing – Insert delays between probes to the same domain; Holehe has no built‑in delay, so wrap calls in asyncio.sleep() or trio.sleep().

3. Prioritization – Skip frequent_rate_limit=True modules when speed matters, or process them in isolated batches with dedicated IP pools.

4. Retry logic – Check rateLimit: True and queue the email/domain pair for reprocessing after a cooldown period.

Key Files for Rate‑Limit Behavior

File Path	Purpose
README.md+)	Master module table with "Frequent Rate Limit" column
holehe/modules/social_media/instagram.py	Example of frequently rate‑limited module
holehe/modules/transport/blablacar.py	Another flagged service implementation
holehe/core.py	Orchestrates execution, aggregates rateLimit flags

Summary

• 31 services are documented as frequently rate‑limited in Holehe's README, marked with ✔ in the "Frequent Rate Limit" column.
• High‑value targets like Google, Instagram, Spotify, eBay, and Yahoo aggressively throttle password‑recovery probes.
• Holehe surfaces throttling via the rateLimit boolean field in module results.
• The frequent_rate_limit metadata flag warns users before execution which modules commonly trigger HTTP 429 responses.
• Developers should implement IP rotation, request delays, and retry queues when targeting these services at scale.

Frequently Asked Questions

How can I tell if a Holehe module was rate‑limited during my scan?

Check the rateLimit field in the result dictionary. If true, the service returned HTTP 429 or equivalent throttling response. The CLI outputs JSON with this field; use jq or grep to filter. Each module in holehe/modules/ consistently includes this key.

Does Holehe automatically retry when rate‑limited?

No. Holehe does not implement automatic retry logic or backoff delays. The tool reports throttling via rateLimit: True and leaves retry strategy to the caller. You must implement your own retry loops with appropriate delays and IP rotation.

Which Holehe modules are most likely to fail due to rate limits?

According to the source README, modules for Google, Instagram, eBay, Spotify, Yahoo, Office365, Patreon, and Garmin are among the most frequently throttled. These are large platforms with advanced bot detection protecting their password‑recovery flows.

Can I exclude frequently rate‑limited modules from a Holehe scan?

Yes. Use the --only-used flag with service selection, or filter modules programmatically by checking the frequent_rate_limit metadata before execution. The Python API lets you import specific modules rather than running the full discovery suite.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}