Holehe
OSINT tool that checks which sites have an email registered via registration, login, and password-reset flows.
Technical Architecture & Overview
Holehe checks whether an email address is attached to an account on more than 120 websites. Each module queries a site's registration, login, or password recovery flow, and the README states that checks do not alert the target email. Output lists registered and unregistered sites, and some modules return partially obfuscated recovery emails or phone numbers.
Targeted Technical Use Cases
Mapping account footprint for an email address during authorized investigations.
Evaluation & Trade-offs
Core Strengths
- +Does not alert the target email address, according to its README.
- +Covers major platforms including social and commerce sites.
- +Simple CLI with CSV export.
Trade-Offs & Limitations
- -Depends on each site's registration, login, or reset flow, which changes over time.
- -Sites can rate-limit requests; module output flags when this happens.
Defensive Security Application
Fraud and account takeover investigations that need to map a compromised email's reach.
Frequently Asked Questions
What is Holehe?→
Holehe checks whether an email address is attached to an account on more than 120 websites. Each module queries a site's registration, login, or password recovery flow, and the README states that checks do not alert the target email. Output lists registered and unregistered sites, and some modules return partially obfuscated recovery emails or phone numbers.
What is Holehe used for?→
Mapping account footprint for an email address during authorized investigations.
What are the strengths of Holehe?→
- +Does not alert the target email address, according to its README.
- +Covers major platforms including social and commerce sites.
- +Simple CLI with CSV export.
What are the limitations of Holehe?→
- +Depends on each site's registration, login, or reset flow, which changes over time.
- +Sites can rate-limit requests; module output flags when this happens.
How is Holehe used defensively?→
Fraud and account takeover investigations that need to map a compromised email's reach.