Holehe Account Detection Methods: Complete Guide to Email Enumeration Techniques

Holehe detects registered accounts across hundreds of online services by invoking service-specific async functions that analyze HTTP responses to determine email registration status.

Holehe is an open-source OSINT tool by megadose/holehe designed to enumerate where an email address has been registered. The project organizes its detection logic into modular, category-based Python modules under holehe/modules/. Each module implements a unique account detection method tailored to a specific platform's API behavior, response codes, and anti-bot measures.

Core Detection Architecture

Every account detection method in Holehe follows a standardized async signature defined in the core orchestration files holehe/__init__.py and holehe/core.py:

async def <service_name>(email: str, client: httpx.AsyncClient, out: dict) -> dict:
    # Service-specific HTTP request and response analysis

    ...

The shared client parameter provides a persistent httpx.AsyncClient for connection pooling. The out dictionary allows modules to share state. Each function returns a standardized result dictionary containing status fields like exists, emailrecovery, or others.

Social Media Detection Methods

Social platforms represent Holehe's largest detection category. Each service requires distinct request patterns and response interpretation logic.

Instagram, Facebook, Twitter, Snapchat

These major platforms reside in holehe/modules/social_media/:

• Instagram (instagram.py): Analyzes registration endpoint responses for error codes indicating existing accounts
• Facebook (facebook.py): Uses login flow validation to detect registered emails without authentication
• Twitter (twitter.py): Examines signup API responses for "email already taken" indicators
• Snapchat (snapchat.py): Validates against account recovery endpoints

Niche and Regional Platforms

Holehe includes detection methods for specialized networks:

Platform	Source File	Detection Approach
Discord	holehe/modules/social_media/discord.py	Registration API response analysis
Pinterest	holehe/modules/social_media/pinterest.py	Account availability endpoints
XING	holehe/modules/social_media/xing.py	Professional network validation
Wattpad	holehe/modules/social_media/wattpad.py	Creative platform enumeration
VSCO	holehe/modules/social_media/vsco.py	Photo community detection
Strava	holehe/modules/social_media/strava.py	Fitness activity platform
Odnoklassniki	holehe/modules/social_media/odnoklassniki.py	Russian social network
Parler	holehe/modules/social_media/parler.py	Alternative social platform

E-Commerce and Shopping Detection

Retail platforms expose account existence through checkout flows and loyalty program endpoints.

Major Retailers

• Amazon (holehe/modules/shopping/amazon.py): Detects via account creation and password reset flows
• eBay (holehe/modules/shopping/ebay.py): Uses registration validation endpoints
• Samsung (holehe/modules/products/samsung.py): Product ecosystem account detection
• Nike (holehe/modules/products/nike.py): Membership program enumeration

Food Delivery and Specialized Retail

Additional shopping detection methods include Dominos, Deliveroo, Garmin, Vivino, and Naturabuy—all implementing service-specific request patterns in holehe/modules/shopping/.

Developer and Programming Platform Detection

Technical platforms often expose account information through public APIs with minimal rate limiting.

Platform	Source File	Detection Technique
GitHub	holehe/modules/programing/github.py	Signup validation endpoint
Replit	holehe/modules/programing/replit.py	Registration API analysis
Codecademy	holehe/modules/programing/codecademy.py	Learning platform enumeration
CodePen	holehe/modules/programing/codepen.py	Developer community detection
TeamTreehouse	holehe/modules/programing/teamtreehouse.py	Education platform validation
DevRant	holehe/modules/programing/devrant.py	Developer forum detection

Music and Streaming Service Detection

Audio platforms implement varying degrees of account enumeration protection.

• Spotify (holehe/modules/music/spotify.py): Analyzes signup form validation responses
• SoundCloud (holehe/modules/music/soundcloud.py): Uses account creation endpoint feedback
• Last.fm (holehe/modules/music/lastfm.py): Scrobbling service account detection
• TuneFind (holehe/modules/music/tunefind.py): Music identification platform enumeration

Email Provider Detection Methods

Verifying email provider accounts helps establish baseline digital presence.

Provider	Source File	Detection Characteristic
Gmail (Google)	holehe/modules/mails/google.py	Google account ecosystem validation
Yahoo	holehe/modules/mails/yahoo.py	Legacy provider account detection
ProtonMail	holehe/modules/mails/protonmail.py	Privacy-focused email enumeration
Mail.ru	holehe/modules/mails/mail_ru.py	Russian email provider detection

Specialized Detection Categories

Payment and Financial Services

• Venmo (holehe/modules/payment/venmo.py): Peer-to-peer payment account enumeration

OSINT and Data Enrichment

• RocketReach (holehe/modules/osint/rocketreach.py): Professional contact database detection

Medical and Health Platforms

• SevenCups (holehe/modules/medical/sevencups.py): Mental health support platform
• CaringBridge (holehe/modules/medical/caringbridge.py): Patient care community detection

Learning and Knowledge Platforms

• Duolingo (holehe/modules/learning/duolingo.py): Language learning account validation
• Quora (holehe/modules/learning/quora.py): Q&A platform enumeration

Transportation and Travel

• BlaBlaCar (holehe/modules/transport/blablacar.py): Carpooling service account detection

How Detection Methods Work Internally

Each account detection method follows a consistent four-phase pattern as implemented across holehe/modules/:

1. Request Preparation

Modules construct HTTP requests with appropriate headers, often rotating User-Agent strings from holehe/localuseragent.py to avoid fingerprinting:

from holehe.localuseragent import ua

headers = {
    "User-Agent": ua["random"],
    "Accept": "application/json",
    # Service-specific headers...

}

2. HTTP Execution

Requests execute through the shared async client:

response = await client.get(
    "https://api.service.com/v1/users/check",
    headers=headers,
    params={"email": email}
)

3. Response Analysis

Detection logic interprets status codes, JSON payloads, or redirect chains:

Indicator	Typical Interpretation
HTTP 200 with "email taken"	Account exists
HTTP 404 / HTTP 204	Account not found
HTTP 409 / HTTP 422	Conflict – often indicates registered
Specific JSON error fields	Service-specific existence signals
Redirect to login page	Usually indicates registered

4. Result Reporting

Functions return standardized dictionaries consumed by the core aggregator in holehe/core.py:

return {
    "name": "service_name",
    "rateLimit": False,
    "exists": True,
    "emailrecovery": None,
    "phoneNumber": None,
    "others": None
}

Running Detection Methods Programmatically

The core orchestration in holehe/core.py demonstrates how detection methods execute:

import httpx
from holehe.core import import_module_names

async def run_detection(email: str) -> dict:
    client = httpx.AsyncClient()
    out = {}
    
    for module_name in sorted(import_module_names()):
        mod = __import__(f"holehe.modules.{module_name}", fromlist=[module_name])
        detection_func = getattr(mod, module_name)
        result = await detection_func(email, client, out)
        if result:
            out[module_name] = result
    
    await client.aclose()
    return out

For single-service verification, import directly:

from holehe.modules.social_media import instagram

async def check_instagram(email: str, client: httpx.AsyncClient) -> dict:
    return await instagram(email, client, {})

Summary

• Holehe organizes account detection methods into 15+ category directories under holehe/modules/
• Each method implements a standard async signature: async def service(email, client, out)
• Detection relies on HTTP response analysis: status codes, JSON payloads, and redirect behavior vary by service
• Core orchestration in holehe/core.py loads modules dynamically and aggregates results
• User-Agent rotation via holehe/localuseragent.py helps evade basic fingerprinting
• Modular architecture enables rapid addition of new platforms without core changes

Frequently Asked Questions

How does Holehe determine if an account exists without logging in?

Each detection method exploits public registration or password-reset endpoints that return distinguishable responses for existing versus non-existing emails. Services respond with HTTP status codes like 409 Conflict or JSON fields indicating "email already in use"—signals Holehe interprets as account existence without requiring authentication.

Can I add custom account detection methods to Holehe?

Yes. Create a new Python file in holehe/modules/<category>/ implementing the standard signature async def servicename(email, client, out). The core's dynamic module loader in holehe/core.py automatically discovers and executes new modules matching the naming convention.

Why do some detection methods fail or return "unknown" status?

Services implement varying anti-enumeration protections including rate limiting, CAPTCHA challenges, and generic error responses. Holehe flags these as rateLimit: True or indeterminate results. The exists field remains None when response patterns don't match known signatures, requiring manual verification or updated detection logic.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}