Holehe Detection Methods Explained: Login, Register, and Password Recovery Checks

Holehe uses four distinct detection methods—login, register, password recovery, and other—to determine whether an email address is associated with accounts across 100+ online services.

Holehe is an open-source OSINT tool developed by megadose that checks if an email address is registered on various websites. Each service module declares a method attribute that tells the engine exactly how to probe for account existence without actually signing in. Understanding these detection methods helps security researchers, penetration testers, and OSINT analysts interpret results accurately and choose the right probes for their investigations.

---

The Four Detection Methods in Holehe

Every module in holehe/modules/ defines a method class attribute that determines which technique the core.py dispatcher uses. Here are the four methods implemented in the codebase:

Login Detection Method

The login method attempts authentication with the supplied email and a dummy password. If the server responds with "wrong password" or similar rather than "email not found," the address is confirmed as registered.

Implementation pattern:

• Sends POST /login or GET /auth with email in payload
• Parses error messages for existence indicators ("incorrect password," "email exists," etc.)
• Never completes actual authentication

Example modules using login detection:

Service	File Path
Snapchat	holehe/modules/social_media/snapchat.py
Patreon	holehe/modules/social_media/patreon.py
Amazon	holehe/modules/shopping/amazon.py

These modules target services that expose sign-in endpoints but restrict account creation (invite-only or closed registration).

---

Register Detection Method

The register method initiates a new account creation flow. If the server reports the email is already taken, Holehe marks the address as present.

Implementation pattern:

• Submits POST /register or GET /signup with email
• Captures responses like "already registered" or "email already in use"
• Abandons flow before account creation completes

Example modules using register detection:

Service	File Path
Blablacar	holehe/modules/transport/blablacar.py
Tumblr	holehe/modules/social_media/tumblr.py
Facebook	holehe/modules/social_media/facebook.py

This method works best on platforms with open registration where anyone can attempt to create an account.

---

Password Recovery Detection Method

The password recovery method triggers a forgot-password flow. The server's response—whether it claims to send a reset link or reports the email as unknown—reveals account status.

Implementation pattern:

• Calls POST /password-recovery or GET /reset endpoints
• Interprets confirmations ("reset link sent") or errors ("email not found")
• Does not actually trigger email delivery in most implementations

Example modules using password recovery detection:

Service	File Path
Adobe	holehe/modules/software/adobe.py
Odnoklassniki	holehe/modules/social_media/odnoklassniki.py
Samsung	holehe/modules/products/samsung.py

Services without accessible login or registration probes often expose this vector through their account recovery flows.

---

Other Detection Method

The other method serves as a fallback category for custom heuristics that don't fit the three standard patterns. These modules may check public profile pages, API endpoints, or service-specific behaviors.

Notable example:

• Office 365 (holehe/modules/software/office365.py)—uses tenant discovery endpoints rather than authentication flows

This method is rarely used; most services map cleanly to one of the three primary detection patterns.

---

How Detection Methods Work in Practice

Each module follows a consistent structure, as shown in this simplified pattern from holehe/modules/social_media/snapchat.py:

class Snapchat:
    method = "login"  # Detection method declaration

    
    async def request(self, client, email):
        # Build and send probe request

        # Parse response for existence indicators

        # Return standardized result dict

        pass

The holehe/core.py dispatcher loads all modules, reads their method attribute, and executes the appropriate request routine. Results return as standardized dictionaries containing:

• email: queried address
• status: "present" or "absent"
• type: detection method used (login, register, or password recovery)

---

Command-Line Usage by Detection Method

Holehe's CLI supports filtering by detection method to speed up scans or target specific probe types:

# Default scan using all detection methods

holehe -l alice@example.com

# Scan only login-based probes

holehe -l alice@example.com --method login

# Restrict to register detection only

holehe -l alice@example.com --only-register

---

Programmatic API Access

For integration into larger workflows, the detection methods are accessible through Holehe's Python API:

import asyncio
from holehe import core

async def check_email_probes(email):
    """Check email against all Holehe detection methods."""
    results = await core.check_email(email)
    
    for service, data in results.items():
        print(f"{service}: {data['status']} (via {data['type']})")

# Execute scan

asyncio.run(check_email_probes("alice@example.com"))

The core.check_email() function automatically iterates through all modules, respecting each one's declared detection method.

---

Summary

• Four detection methods power Holehe's email enumeration: login, register, password recovery, and other
• Each module declares its method attribute in holehe/modules/ subdirectories by service category
• Login detection probes authentication endpoints with dummy credentials
• Register detection attempts account creation to trigger "already exists" responses
• Password recovery detection abuses forgot-password flows to confirm account linkage
• Results standardize across all methods into present/absent status with method provenance

---

Frequently Asked Questions

What is the most reliable detection method in Holehe?

Login detection generally provides the highest confidence because authentication endpoints are explicitly designed to validate account existence. However, rate limiting and CAPTCHA protections often make register and password recovery methods more practical for high-volume scanning. The best method depends on the target service's defensive posture.

Can services block Holehe detection methods?

Yes. Services implement various countermeasures: IP-based rate limiting, CAPTCHA challenges, requiring JavaScript execution, or returning ambiguous error messages. The method abstraction allows Holehe contributors to switch detection vectors when one path becomes unreliable—moving from login to register detection, for example.

How does Holehe choose which detection method to use for a service?

Module authors select the method attribute based on which endpoint provides the cleanest existence signal. According to the megadose/holehe source code, this is determined during module development by manually testing each service's responses. The core.py dispatcher respects this declaration without override capability in standard usage.

Why would I filter scans by detection method?

Filtering reduces time-to-result and operational footprint. Login probes may trigger security alerts more readily than register checks. Password recovery flows sometimes bypass stricter authentication protections. Targeting specific methods also helps validate findings—cross-referencing login-detected accounts against register probes increases confidence in positive matches.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}