Holehe turns account-recovery behavior into an OSINT signal
Holehe accepts an email address and queries signup, login, or password-recovery paths on outside services. A module interprets each response as registered, absent, or rate limited, and may return a masked recovery email or phone number. The README lists more than 120 providers. That breadth is useful during an authorized investigation because one command can find leads that would otherwise require many manual forms.
A result proves less than the interface suggests. A positive signal says a provider responded as if that address has an account. It does not prove who controls the address, whether the account is active, or whether the response parser understood a new captcha or error page. Shared addresses, recycled mailboxes, aliases, and provider changes all complicate attribution. Every hit needs a second source before it enters a report.
The 9-second build passed without a test target
We cloned commit 14da70f into a fresh unprivileged Debian container with 3 CPUs and 8 GB of RAM. Installing 48 Python packages took 36 seconds and occupied 42 MB. The build completed in 9 seconds. Pip-audit found 0 known vulnerabilities in the installed dependencies. These are reassuring packaging results for a small command-line application.
The checkout itself was 0.4 MB, with 162 files and about 8,196 source lines. Our scan found one CI workflow and a Dockerfile, but no tests directory. The repository exposed no test script or target, so the harness skipped tests. A passing package build confirms that an artifact can be produced; it does not verify any live site's response or the parsing logic in more than 120 modules.
What happened when we ran it
Our sandbox installed Holehe in 36 seconds and built it in 9 seconds. No dependency or compiler error appeared, and the installed 48-package environment used 42 MB. We did not submit an email address to providers, trigger password recovery, measure coverage, or test whether a target received a notification. Those actions would require a controlled identity and a separately defined authorization scope.
Tests were skipped because the repository supplied no test target. The 0-vulnerability pip-audit result covers known advisories in that resolved environment, not the correctness or policy safety of network probes. For this kind of tool, mocked response tests are especially important: an HTML or JSON change can turn a rate-limit page into a false registration result while the Python package still imports and builds normally.
Provider drift can convert an error into a false hit
Open pull request #311 explains a current Imgur failure mode. According to its author, captcha, unsuccessful, malformed, or missing-availability responses can cause the module to report every email as registered. The proposed change treats those responses as rate limited and adds mocked tests. Until that fix is merged and released, Imgur results from the master branch need manual rejection or a local patch.
Issue #174 reports seeing rate-limit status on a first run even when manual browser access worked. Different endpoints, headers, IP reputation, and automation detection can all produce such a difference, but the report does not isolate one cause. The correct response is to record the probe as inconclusive. Rotating an IP until the service answers may violate provider rules and can look like deliberate evasion.
The Docker instruction has an open runtime failure
The README provides a short Docker build and run sequence. Issue #232 says that path produced an exception on Windows Docker Desktop because the update check expected a response object with a JSON method. That report was opened in September 2025 and remained active in August 2026. A container image therefore needs a smoke test that runs the actual CLI, not only a successful image build.
Direct Python installation was cleaner in our 36-second run, yet packaging is the easy part. A responsible deployment needs low concurrency, clear logs, redaction of queried addresses, and a retention policy for results. CI should use mocked provider responses rather than repeatedly probing real account forms. Live canaries should use accounts the operator owns and should stop on captcha or rate-limit responses.
September 2024 code activity is the maintenance warning
GitHub recorded the last push to the default branch on September 10, 2024. The repository had 14,259 stars and 115 combined issues and pull requests when fetched on August 26, 2026. New issues and contributions were still arriving, including the August 2026 Imgur fix, but the two-year gap in default-branch commits shows that contributor activity has not become merged maintenance. There is also no latest GitHub release.
That history matters more here than it would for a parser over a stable file format. Holehe depends on outside forms that can change without notice. Maigret and Sherlock are better fits for username searches, while socialscan offers a narrower email and username scope. Holehe remains useful as inspectable reconnaissance code, provided the operator validates selected modules, records uncertainty, and never turns its output into an accusation or automated eligibility decision.