# What Is the ua User Agent Dictionary in Holehe: Purpose and Implementation

> Discover the purpose of the ua user agent dictionary in Holehe. Learn how it uses realistic browser strings to mimic traffic and bypass detection.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: deep-dive
- Published: 2026-08-19

---

**The `ua` dictionary defined in [`holehe/localuseragent.py`](https://github.com/megadose/holehe/blob/main/holehe/localuseragent.py) stores a curated collection of realistic browser User-Agent strings that Holehe modules randomly rotate to mimic genuine web traffic and evade anti-automation detection systems.**

The megadose/holehe repository is an open-source OSINT (Open Source Intelligence) framework designed to check email addresses against hundreds of online services. To prevent automated requests from being blocked by defensive filters, the codebase implements the `ua` user agent dictionary as a centralized utility for generating authentic HTTP headers.

## What Is the ua Dictionary in holehe/localuseragent.py?

The `ua` dictionary is defined in **[`holehe/localuseragent.py`](https://github.com/megadose/holehe/blob/main/holehe/localuseragent.py)** and organizes authentic HTTP User-Agent strings by browser family. The data structure categorizes identifiers into lists such as **`chrome`**, **`firefox`**, **`safari`**, and **`iOS`**, allowing modules to select headers that match the expected traffic patterns of their target services.

This centralized approach ensures consistency across the codebase while providing the flexibility needed to impersonate different devices and browsers. Rather than hardcoding static strings that trigger bot detection, modules dynamically pull from these categorized lists.

## How Randomized User Agents Improve OSINT Success Rates

Online services employ sophisticated anti-automation mechanisms that flag requests lacking plausible User-Agent headers or using identical identifiers across multiple connections. The `ua` dictionary enables **request header rotation**, which provides three critical advantages:

- **Improved request success rates** – Services accept calls that appear to originate from legitimate browsers rather than scripts.
- **Avoidance of rate-limiting and CAPTCHAs** – Static or missing User-Agent strings often trigger immediate defensive filters.
- **Traffic pattern diversity** – Random selection via `random.choice()` prevents signature-based detection during bulk email verification tasks.

By varying the identifier on each HTTP call, Holehe presents automated probes as ordinary browser sessions.

## Implementing User-Agent Rotation in Holehe Modules

Holehe modules import the dictionary and utilize Python’s `random` module to select headers dynamically. The standard implementation follows this pattern:

```python
from holehe.localuseragent import ua
import random

headers = {
    "User-Agent": random.choice(ua["browsers"]["chrome"]),
    "Accept-Language": "en-US,en;q=0.5",
}

```

In **[`holehe/modules/social_media/facebook.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/facebook.py)**, the module selects a Chrome User-Agent to blend with standard desktop traffic when querying Facebook’s endpoints. The same pattern appears in **[`holehe/modules/social_media/instagram.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/instagram.py)**, which uses Chrome identifiers to avoid detection while verifying account existence.

For platforms requiring mobile authenticity, modules access the iOS category:

```python

# Mobile-specific endpoint handling

ios_ua = random.choice(ua["browsers"]["iOS"])
headers = {"User-Agent": ios_ua}
response = requests.get("https://mobile.example.com/api/check", headers=headers)

```

## Browser-Specific Strategies Across Holehe Services

Different online services expect different client signatures, and Holehe’s module architecture leverages the full range of the `ua` dictionary to match these expectations:

- **Chrome**: Used by **[`holehe/modules/music/spotify.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/music/spotify.py)**, Facebook, and Instagram modules to represent standard desktop browser traffic.
- **Firefox**: Selected by **[`holehe/modules/software/lastpass.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/lastpass.py)** and **[`holehe/modules/transport/blablacar.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/transport/blablacar.py)** to match security-conscious or region-specific services that may expect alternative browser signatures.
- **iOS**: Provides mobile browser authenticity for services that serve different content or require mobile-specific headers to access certain API endpoints.

This strategic flexibility allows each module to adopt the persona most likely to succeed against its specific target platform.

## Summary

- **Centralized utility**: The `ua` dictionary in **[`holehe/localuseragent.py`](https://github.com/megadose/holehe/blob/main/holehe/localuseragent.py)** provides categorized, realistic User-Agent strings organized by browser family.
- **Evasion mechanism**: Random selection via `random.choice(ua["browsers"]["chrome"])` prevents pattern detection by anti-bot systems.
- **Module integration**: Files like **[`holehe/modules/social_media/facebook.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/facebook.py)** and **[`holehe/modules/software/lastpass.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/lastpass.py)** import and utilize the dictionary for stealthy HTTP requests.
- **Strategic flexibility**: Different browser families allow modules to match expected client types, from desktop Chrome sessions to mobile iOS traffic.

## Frequently Asked Questions

### Where is the ua user agent dictionary defined in Holehe?

The dictionary is defined in **[`holehe/localuseragent.py`](https://github.com/megadose/holehe/blob/main/holehe/localuseragent.py)** at the repository root. This file contains the curated lists of browser-specific User-Agent strings that are imported by various OSINT modules throughout the codebase to generate authentic headers.

### Why does Holehe randomize User-Agent headers instead of using a static string?

Static or missing User-Agent headers trigger anti-automation filters and CAPTCHA challenges on most modern web services. Randomizing headers for each request makes the traffic appear organic, significantly improving success rates and preventing rate limits during bulk email verification operations.

### Which Holehe modules utilize the ua dictionary?

According to the source analysis, the dictionary is used by **[`holehe/modules/social_media/facebook.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/facebook.py)**, **[`holehe/modules/social_media/instagram.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/instagram.py)**, **[`holehe/modules/software/lastpass.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/lastpass.py)**, **[`holehe/modules/music/spotify.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/music/spotify.py)**, and **[`holehe/modules/transport/blablacar.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/transport/blablacar.py)**, among others. Each module selects browser-specific strings appropriate for its target service.

### What browser families are available in the ua dictionary?

The dictionary includes **`chrome`**, **`firefox`**, **`safari`**, and **`iOS`** browser categories. Modules select from these lists based on the target service’s typical user base, with Chrome being the most commonly used category for desktop-oriented checks and iOS providing mobile browser authenticity.