Holehe Module Ranking by Rate Limiting Frequency: 28 High‑Throttling Services Explained
Holehe marks 28 service modules with frequent_rate_limit=True, placing them in the highest rate‑limiting tier, while all remaining modules (~140+) are classified as low or no throttling.
The open‑source OSINT tool Holehe (maintained by megadose/holehe) categorizes every service module by its API throttling behavior. Each module exposes a boolean frequent_rate_limit flag that determines how aggressively Holehe expects the target service to enforce request limits. Understanding this ranking helps security researchers and investigators optimize their workflows against aggressively protected platforms.
How Holehe Classifies Rate‑Limiting Severity
The frequent_rate_limit flag is defined directly in each module's source file. When True, the module expects HTTP 429 responses, CAPTCHA challenges, or IP bans after minimal request volume. This classification drives Holehe's internal scheduling and retry logic.
# Example from holehe/modules/social_media/instagram.py
frequent_rate_limit = True # Instagram aggressively throttles unauthenticated checks
Modules with frequent_rate_limit=False typically permit higher throughput or implement softer rate limits (e.g., per‑hour rather than per‑minute quotas).
Complete Module Ranking: Most to Least Rate‑Limiting
High‑Frequency Rate‑Limited Modules (frequent_rate_limit=True)
These 28 modules comprise the strictest tier, spanning 12 service categories:
Low/No Rate‑Limited Modules (frequent_rate_limit=False)
All remaining modules—approximately 140+ files—fall into this category. Notable examples include most modules under:
holehe.modules.software.*holehe.modules.cms.*holehe.modules.company.*holehe.modules.real_estate.*holehe.modules.sport.*- Many
holehe.modules.social_media.*modules not listed above
Programmatically Filtering by Rate‑Limiting Tier
holehe's Python API exposes the frequent_rate_limit flag at runtime. Use this to build conditional logic for high‑volume investigations:
from holehe.core import HoleHe
h = HoleHe()
results = h.check(email="target@example.com")
# Separate modules by rate‑limiting severity
high_throttle = []
low_throttle = []
for module_name, data in results.items():
if data.get("frequent_rate_limit"):
high_throttle.append(module_name)
print(f"[HIGH RISK] {module_name} – expect aggressive throttling")
else:
low_throttle.append(module_name)
print(f"[LOW RISK] {module_name} – permissive rate limits")
print(f"\nSummary: {len(high_throttle)} high‑throttle, {len(low_throttle)} low‑throttle modules")
This pattern is essential when chaining Holehe with proxy rotation or distributed execution frameworks.
Why Specific Services Trigger Higher Throttling
Based on the megadose/holehe source code, high‑frequency rate limiting correlates with:
- Enterprise security posture: Services like
instagram,spotify, andyahoooperate at massive scale with dedicated anti‑abuse teams - Financial sensitivity: Payment platforms (
venmo) and shopping sites (ebay,garmin) enforce strict transaction‑protecting limits - Content moderation needs: Forums (
blackworldforum,demonforums) and adult platforms (xnxx) aggressively filter automated access - API monetization: Services like
replitandcodecademythrottle to preserve paid tier differentiation
Summary
- 28 modules in Holehe carry
frequent_rate_limit=True, marking them as the most aggressively throttled services - Social media dominates the high‑throttle tier with 7 modules (
instagram,patreon,imgur,wattpad,taringa,crevado, plus related platforms) - Music, shopping, and forums each contribute 4+ high‑throttle modules
- ~140+ remaining modules operate under relaxed or negligible rate limits
- The
frequent_rate_limitboolean is queryable at runtime for dynamic workflow adaptation
Frequently Asked Questions
How does Holehe determine which modules get frequent_rate_limit=True?
The flag is manually assigned by module contributors based on empirical testing against each service's live API. The megadose/holehe maintainers update these classifications as platforms evolve their anti‑automation defenses. No automated heuristics are used; each module's source file explicitly sets the boolean.
Can I override rate‑limiting behavior for high‑throttle modules?
Holehe respects each module's frequent_rate_limit flag for scheduling purposes, but you control execution parallelism externally. Use proxy pools, request jitter, and retry backoffs when targeting the 28 high‑throttle services—especially instagram.py and yahoo.py which implement the strictest IP‑based blocking.
Why do some obviously large platforms lack the high‑throttle flag?
Services like Twitter/X or LinkedIn may use frequent_rate_limit=False because their checks rely on unauthenticated endpoints with different throttling policies than authenticated API routes. Conversely, platforms with strict signup‑page enumeration protection (e.g., venmo.py) earn the True classification despite smaller user bases.
Have a question about this repo?
These articles cover the highlights, but your codebase questions are specific. Give your agent direct access to the source. Share this with your agent to get started:
curl -s "https://instagit.com/install.md" 
Maintain an open-source project? Get it listed too →