This week, BleepingComputer reported that the ShinyHunters extortion group leaked data from 1.6 million RingCentral accounts, citing the breach notification service Have I Been Pwned. Names, email addresses, phone numbers, physical addresses – the whole profile, verified against the leaked dump after the company refused to pay. Every time a story like this lands, I ask myself the same question: how many of the accounts behind this email address would I even remember if I had to list them?
The honest answer for most of us is “not many.” That gap is where a small open-source tool called holehe earns its keep. It quietly checks whether your email address is registered on more than 120 websites, using only the account-existence signals those sites expose – no login, no password reset, and no alert sent to your inbox. Let me show you how to run it.
Why Your Email Address Is a Map of Your Digital Life
Email is the universal identifier of the internet. A decade of signups means one address can be the key to a forgotten forum from college, a trial account you never cancelled, and the work profile tied to your real name. Attackers know this. Breached lists get cross-referenced, and one leaked address becomes the starting point for credential-stuffing attempts against every service that recognizes it.
That is why the footprint matters more than the password. Password managers handle the credentials, but they cannot tell you which accounts exist in the first place – and an account you forgot about is an account you are not watching. Keeping the list honest is the first step of checking if your AI accounts have been hacked, and the same logic applies to everything else your email touches.
What holehe Actually Does
holehe is a command-line OSINT tool by a developer who goes by megadose, published on GitHub under the GPL v3 license with an explicit “built for educational purposes only” warning. It supports Twitter, Instagram, GitHub, Imgur, Adobe, Amazon, Docker, Discord, Spotify, and over a hundred more – my test run checked 121 sites.
For each service, holehe uses one of three methods: the forgotten-password flow, the signup check, or the login check. The trick is that it never completes any of them. It inspects the response – “this email is not registered,” “enter your recovery email,” “account found” – and records what it learns, including partially masked recovery emails and phone numbers when the service leaks them in the response.
Two properties make it special. First, it does not alert the target: no reset email is ever sent, so the owner of the address does not get a suspicious “someone tried to log in” notification. Second, it only reports existence and recovery hints – it cannot pull your chats, your files, or your password hash. It is an index, not a vault.
Installing holehe
The install is a single pip command. I tested it on a clean Python 3 environment:
pip3 install holehe
holehe --helpIf –help prints the plain English flag list, you are ready. The current release is 1.61, which has been the stable version on PyPI since July 2022 – it is an old, proven tool that has not needed a new release in four years. Docker users get the same result with two commands from the repository README.
Running Your First Scan
The basic invocation is just the address:
holehe [email protected]You will see a progress bar fly by, then the verdict table. Each line gets one of three markers:
- [+] Email used – an account exists for that service
- [-] Email not used – no account found
- [x] Rate limit – the service refused to answer, usually because of your current IP
Three flags matter for real use. --only-used hides the negatives and shows just the services where your address appears, which is what you want for a cleanup session. -T 5 caps each request timeout so a slow service does not stall the whole scan. And -C exports a CSV you can keep as a record. There is also -NP if you want to skip the password-recovery checks entirely.
What I Saw When I Tested It
I ran holehe against a throwaway address, not a real person’s inbox, to document the output honestly. Installation was clean, and all 121 modules executed in under a second. What the scan showed is the tool’s most important real-world behavior: my test box sits on a data-center IP, so almost every service answered with a rate-limit marker rather than a clean yes or no. The README’s advice for that situation is blunt – “Rate limit? Change your IP.”
That is not a bug, and I want the article to be clear about it. Services treat shared and data-center addresses as suspicious by design, so a wall of [x] markers on a corporate or cloud network is normal. Run it from your home connection, on your own email address, and the majority of services will answer cleanly. The lesson transfers to real life too: if a scan against your own address ever shows an account somewhere you never signed up for, that is your cue to lock that one down the way you would rotate a password.
Reading the Data Beneath the Table
If you are a security analyst, the CLI table is just the surface. Each module returns structured JSON with four interesting fields: exists for the verdict, emailrecovery and phoneNumber for the masked recovery hints some services reveal, and rateLimit to flag unreliable answers. Developers can import a single module and drive it from Python with trio and httpx, which is exactly how the tool gets embedded into bigger OSINT pipelines. There is even a Maltego transform and a hosted web version at osint.industries if you prefer a browser.
Pair the results with a breach service for the full picture. holehe answers “where am I registered?” – Have I Been Pwned answers “which of those registrations have been leaked?” Together they turn an abstract risk into a concrete to-do list of accounts to delete or secure.
Where to Draw the Line
holehe is an OSINT tool, which means the ethics live with the operator, not the software. Use it on emails you own or that you are explicitly authorized to investigate. Probing other people’s addresses is exactly the behavior the services are rate-limiting against, and it creates the kind of noise that gets researchers on mailing lists with no warning. On your own accounts, though, it is one of the least invasive checks in the security toolkit – it does not log in, does not send mail, and leaves almost no trace.
Add It to Your Monthly Security Routine
An email footprint scan takes thirty seconds and slots perfectly into the security habits I keep recommending. Do it on the same cadence as the Chrome extension check I wrote up, review the accounts against your npm supply-chain audit list, and remember that a forgotten account is a standing invitation – the same class of hole the Keyv npm worm exploit found in package caches.
Every breach that surfaces another batch of addresses makes the exercise more valuable, not less. The RingCentral leak is this week’s reminder; next month it will be someone else’s. Knowing exactly where your email can be used is a small, quiet advantage – install holehe, scan once, and decide which doors you actually want to keep open.