Holehe OSINT: Check Email Registrations Across 120+ Platforms

Confirming a target email address’s digital footprint across dozens of platforms during a penetration test or OSINT investigation typically involves manually testing forgotten password flows site by site. This is slow, noisy when done incorrectly, and easy to miss. Holehe automates this verification silently by querying over 120 services through password recovery mechanisms without triggering alerts to the target mailbox.

Built by megadose and written entirely in Python 3, the tool sends carefully crafted password reset requests and evaluates server responses to determine account registration status. You can review the full module library and source code on the official Holehe GitHub repository. Security researchers, digital forensics teams, and CTF players use it to rapidly map out a target’s online presence during early reconnaissance.

How Holehe Detects Account Registrations Without Alerting Targets

Most platforms expose account existence through their forgotten password flows. Submitting an email to a password reset form returns one of two distinct responses: a confirmation that a reset link was sent, or an error stating that no account matches the address.

Holehe exploits this behavior programmatically. It sends asynchronous HTTP requests to each supported platform’s password recovery endpoint and classifies the server’s response without ever clicking a reset link or modifying account state. No password reset email reaches the inbox. No login attempt is recorded. The target remains unaware of the probe.

This differs fundamentally from registration checking, where some tools attempt to create new accounts and check whether the email is already taken. That technique leaves registration attempt logs visible to platform abuse detection systems.

Installing Holehe via pip, GitHub, or Docker

PyPI provides the quickest install path for most Linux and macOS environments.

# Install Holehe directly from PyPI
pip3 install holehe

# Verify the installation works correctly
holehe --help

Git clone installation gives you the latest development commits and the complete module source files for review or modification.

# Clone and install from GitHub source
git clone https://github.com/megadose/holehe.git
cd holehe/
python3 setup.py install

Docker wraps the runtime into a portable container with all dependencies pre-installed. This is the cleanest approach for running Holehe inside air-gapped lab environments or shared investigation servers.

# Build and run the Holehe Docker image
docker build . -t my-holehe-image
docker run my-holehe-image holehe test@gmail.com

Running Email Lookups from the CLI

The standard command is a single line. Pass the target email address as the argument, and Holehe queries all available modules in parallel.

# Run a full cross-platform email lookup
holehe target@example.com

Output highlights each platform name alongside the detection result. Confirmed registrations display with a green indicator. Platforms returning a “not found” response display differently. Platforms that are inaccessible during the scan get flagged as errors rather than false negatives.

Embedding Holehe into Python OSINT Pipelines

Holehe exposes every platform module as a standalone async Python function. This makes it trivial to embed email lookup logic into larger investigation automation scripts without relying on the CLI.

import trio
import httpx
from holehe.modules.social_media.snapchat import snapchat
from holehe.modules.development.github import github

async def investigate_email(email_address):
    results = []
    async with httpx.AsyncClient() as client:
        # Query Snapchat and GitHub modules concurrently
        await trio.gather(
            snapchat(email_address, client, results),
            github(email_address, client, results)
        )
    return results

# Execute the async investigation function
email_results = trio.run(investigate_email, "target@example.com")
print(email_results)

Each module function accepts the email address, a shared httpx.AsyncClient instance, and a mutable output list. Results append dictionaries containing the platform name, registration status, and any additional extracted data fields the platform exposes.

Building multi-email batch investigations becomes straightforward once the async pattern is established. Feed a list of suspected addresses through the same investigation function inside a loop to generate cross-referenced presence maps. This workflow integrates naturally alongside other OSINT pipelines that rely on the Python scripting techniques commonly used in ethical hacking workflows.

Operational Security Considerations for Investigators

Running Holehe against a target from your real IP address creates outbound request logs on every platform’s server. Use a VPN, a Tor exit node, or route your requests through a proxy to add a layer of operational separation.

Some platforms actively rate-limit or block automated password reset requests after repeated queries from the same IP within a short window. Spacing requests across multiple investigation sessions and rotating exit nodes prevents triggering temporary access bans that could invalidate partial results.

Platform module accuracy degrades over time as services update their password recovery flows. An “account not found” result on a platform whose module is outdated could represent a false negative rather than genuine absence. Cross-validate critical findings manually for high-stakes investigations.