What Detection Methods Does Holehe Use Besides Registration Checks?

Holehe employs four distinct detection strategies—registration checks, login probing, password recovery flows, and bespoke API requests—to determine if an email address is associated with online services without ever creating an actual account.

Holehe is an open-source email reconnaissance tool developed by megadose that verifies whether an address is registered across hundreds of online platforms. While many assume it only relies on signup forms, the megadose/holehe codebase implements multiple probing vectors to maximize coverage. Each module in holehe/modules/ explicitly declares its detection technique via a method string, enabling the core engine to orchestrate diverse validation strategies uniformly.

The Four Detection Strategies in Holehe

Registration Availability (register)

The most common technique involves simulating account creation attempts. In holehe/modules/transport/blablacar.py, the tool either submits a registration request or queries a dedicated "check-email-available" endpoint. When the service responds that the email is already in use, Holehe flags the address as associated with that platform. This method relies on the fact that most services expose a quick "email-already-used" response during the signup flow.

Login Endpoint Probing (login)

For services that leak existence data through authentication errors, Holehe transmits login requests with dummy credentials. The Snapchat module in holehe/modules/social_media/snapchat.py demonstrates this approach by sending the target email paired with an invalid password. The server's error response—distinguishing between "account does not exist" and "incorrect password"—reveals whether the email is registered without requiring valid login credentials.

Password Recovery Exploitation (password recovery)

Some services expose account existence through their "forgot password" workflows. In holehe/modules/software/adobe.py, the module invokes the account recovery endpoint and analyzes the response. If the service returns a confirmation message, security hints, or recovery options, the email is confirmed as registered; unknown addresses typically receive a "not found" or "no account associated" response. This method proves effective when registration and login endpoints are hardened against enumeration.

Custom API Validation (other)

Certain platforms require unique validation logic that does not fit standardized patterns. The Office 365 check in holehe/modules/software/office365.py uses bespoke API calls that return boolean existence flags for organizational tenants. These implementations are categorized under method = "other", allowing authors to devise service-specific requests while maintaining compatibility with the core reporting structure.

How the Core Engine Orchestrates Detection Methods

The maincore() function in holehe/core.py serves as the asynchronous execution engine that coordinates all detection methods. It dynamically imports every module via import_submodules("holehe.modules"), extracts callable functions using get_functions, and dispatches them concurrently through launch_module.

Each module returns a standardized result dictionary that always contains a method field (e.g., method = "login"). This design ensures consistent output formatting across all detection strategies, regardless of whether the underlying check exploited a registration form, login error, or recovery flow. The core driver aggregates these results and displays them uniformly, whether the match came from BlaBlaCar's registration endpoint or Adobe's password recovery system.

Support utilities enhance these probing capabilities. The holehe/localuseragent.py file supplies realistic User-Agent strings to avoid trivial fingerprinting, while holehe/instruments.py provides progress-bar instrumentation for the asynchronous runner.

Practical Usage Examples

Execute Holehe from the command line to run all detection methods against a target address:

# Basic usage – check an email against every supported service

holehe alice@example.com

# Show only the services where the address is known

holehe alice@example.com --only-used

# Suppress color output (useful for pipelines)

holehe alice@example.com --no-color

# Export the full result set to CSV

holehe alice@example.com --csv

The CLI invokes maincore() to run modules asynchronously, collecting results that include the specific detection method used for each positive match.

Summary

• Holehe categorizes every service check into one of four methods: register, login, password recovery, or other.
• Each module explicitly defines its technique via a method variable (e.g., method = "login" in social_media/snapchat.py), allowing the tool to select the most reliable vector for each platform.
• The asynchronous engine in holehe/core.py executes all checks concurrently via launch_module, normalizing results regardless of whether they originated from registration forms or recovery endpoints.
• Auxiliary components like localuseragent.py provide rotation capabilities to prevent blocking during these enumeration attempts.

Frequently Asked Questions

Does Holehe actually create accounts when using the register method?

No. The tool only simulates the initial registration request or queries dedicated availability endpoints without completing account creation. It interprets "email already taken" or similar HTTP responses as confirmation that the address is registered, then immediately discards the session.

How does Holehe avoid rate limiting when probing login endpoints?

The codebase employs asynchronous concurrency controls and rotates realistic User-Agent strings via holehe/localuseragent.py. While this helps avoid trivial blocks, the tool performs rapid requests across hundreds of services, so users should implement appropriate delays and respect target platform terms of service.

What determines which detection method a specific module uses?

Module authors select the technique based on the target service's API behavior and security posture. If a service exposes a password reset flow that reveals account existence (like Adobe), the module uses method = "password recovery"; if login error messages leak existence data (like Snapchat), it uses method = "login" instead.

Can I see which detection method was used for each service result?

Yes. Every result dictionary returned by the core engine includes a method field indicating whether the match came from "register", "login", "password recovery", or "other" checks. This metadata appears in standard CLI output and remains available when exporting results to CSV using the --csv flag.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}