Holehe Email OSINT Scraper - Find Accounts by Email

Disclaimer: This Actor is an independent tool and is not affiliated with, endorsed by, or sponsored by the Holehe open-source project. All trademarks mentioned are the property of their respective owners. "Holehe" is referenced only to describe the kind of check this Actor performs.

Investigate an email address the way Holehe does. For each email you get one record with:

• Site registrations - whether the address is registered on 34 sites (36 with the optional adult sites), each answered as registered, not_registered or unknown, checked live on every run.
• Gravatar profile - when the address has a public Gravatar: avatar URL, display name, username, full name, location, bio, job title, company, pronouns, the social accounts the owner verified (with their usernames), their links, and any public e-mail or contact details they chose to show.
• Sign-in clues - the social logins (Google, Facebook, Apple) that Adobe or Duolingo report as linked to the address, Adobe's account type and status.
• OSINT footprint URLs - ready-made Google dorks, LinkedIn and Facebook searches, and breach-check links (Have I Been Pwned, DeHashed, Intelligence X).

No login, no API key, no setup.

Sites checked

Site	What "registered" means
WordPress.com	a WordPress.com account uses this e-mail
Duolingo	a Duolingo account uses this e-mail (plus which social logins are linked)
Plurk	a Plurk account uses this e-mail
Firefox	a Mozilla (Firefox) account uses this e-mail
X (Twitter)	the e-mail is already taken on X
Spotify	a Spotify account uses this e-mail
Chess.com	the e-mail is in use on Chess.com
Adobe	an Adobe ID uses this e-mail (plus account type, sign-in methods and status)
LastPass	a LastPass account uses this e-mail
Freelancer	a Freelancer.com account uses this e-mail
Snapchat (Bitmoji)	a Bitmoji / Snapchat account uses this e-mail
Microsoft	a Microsoft account (Outlook, Microsoft 365) uses this e-mail. Addresses at Microsoft's own domains (outlook.com, hotmail.com and the like) read unknown, because Microsoft answers yes for every address there
Flickr	a Flickr account uses this e-mail
Rambler	a Rambler ID uses this e-mail
Insightly	an Insightly CRM account uses this e-mail
amoCRM	an amoCRM account uses this e-mail
Any.do	an Any.do account uses this e-mail
Pinterest	a Pinterest account uses this e-mail
Coursera	a Coursera account uses this e-mail
Hugging Face	a Hugging Face account uses this e-mail
HackerRank	a HackerRank account uses this e-mail
Wix	a Wix account uses this e-mail
MyAnimeList	a MyAnimeList account uses this e-mail. Addresses at providers MyAnimeList refuses (hotmail.com, for one) read unknown
MyFitnessPal	a MyFitnessPal account uses this e-mail
Skyscanner	a Skyscanner account uses this e-mail
MeWe	a MeWe account uses this e-mail
Flipboard	a Flipboard account uses this e-mail
Medal	a Medal account uses this e-mail
ClassDojo	a ClassDojo account uses this e-mail
start.me	a start.me account uses this e-mail
Neocities	a Neocities site account uses this e-mail
JustWatch	a JustWatch account uses this e-mail
Fox	a Fox account (Fox News, Fox Nation, Fox Sports) uses this e-mail
Al Jazeera	an Al Jazeera account uses this e-mail
XNXX (optional, off by default)	the site says the e-mail is in use or its owner excluded it
XVideos (optional, off by default)	the site says the e-mail is in use or its owner excluded it

Every check asks the site's own sign-up or sign-in endpoint one read-only question. Nothing creates an account, resets a password or sends the address owner an e-mail.

How the results work (read this)

• Three answers, never a guess. registered and not_registered come only from the site's own clear answer. A rate limit, a refusal, a timeout or an answer the site has never given before is unknown, and the site is listed in unknownOn with the reason in siteResults. A lookup that gets no answer (a timeout, a refusal, a rate limit or a server error) is asked up to two more times, each time on a fresh IP when the default proxy is on.
• Sites change. Many sites have closed the "is this e-mail registered?" question over the years, so this Actor runs only checks that answered correctly in live tests (known accounts read as registered, a made-up address as not registered). Some sites reject addresses they consider fake or disposable (Spotify, Chess.com, Freelancer, Medal and Neocities among them) and MyAnimeList refuses some e-mail providers: those answer unknown.
• Gravatar shows what the owner made public. Most addresses have no Gravatar; then gravatar.exists is false. When Gravatar does not answer clearly, it is null with the reason, never "no profile".
• Billing follows the answers. An email is billed only after at least one lookup answered for it. Entries that are not e-mail addresses are skipped, named on the run summary and never billed. From 16 November 2026 each run also pays Apify's Actor Start fee (see How much does it cost?).

Example output

A default run for admin@gmail.com (lists shortened):

{
  "type": "email",
  "email": "admin@gmail.com",
  "valid": true,
  "checkedAt": "2026-11-02T02:13:06.221Z",
  "gravatar": { "exists": false, "profileUrl": null, "displayName": null, "location": null, "accounts": null, "status": "not_found", "username": null, "avatarUrl": null },
  "registeredOn": ["WordPress.com", "Duolingo", "Plurk", "X (Twitter)", "Spotify", "Chess.com", "Adobe", "LastPass", "Freelancer", "Snapchat (Bitmoji)", "Microsoft", "Flickr", "Rambler", "Insightly", "amoCRM", "Any.do", "Pinterest", "Coursera", "Hugging Face", "HackerRank", "Wix", "MyAnimeList", "MyFitnessPal", "Skyscanner", "Flipboard", "Medal", "ClassDojo", "start.me", "Neocities", "JustWatch", "Fox", "Al Jazeera"],
  "checkedSites": 34,
  "registeredCount": 32,
  "footprintUrls": [
    { "kind": "breach", "name": "Have I Been Pwned", "url": "https://haveibeenpwned.com/account/admin%40gmail.com" },
    { "kind": "google", "name": "Google exact", "url": "https://www.google.com/search?q=%22admin%40gmail.com%22" }
  ],
  "registeredOnText": "WordPress.com, Duolingo, Plurk, X (Twitter), Spotify, Chess.com, Adobe, LastPass, Freelancer, Snapchat (Bitmoji), Microsoft, Flickr, Rambler, Insightly, amoCRM, Any.do, Pinterest, Coursera, Hugging Face, HackerRank, Wix, MyAnimeList, MyFitnessPal, Skyscanner, Flipboard, Medal, ClassDojo, start.me, Neocities, JustWatch, Fox, Al Jazeera",
  "notRegisteredOn": ["Firefox", "MeWe"],
  "unknownOn": [],
  "answeredSites": 34,
  "siteResults": [
    { "site": "Duolingo", "status": "registered", "reason": null, "details": { "signInWith": ["Google"], "hasCustomAvatar": false }, "detailsText": "linked logins Google; default avatar" },
    { "site": "Firefox", "status": "not_registered", "reason": null, "details": null, "detailsText": null },
    { "site": "Adobe", "status": "registered", "reason": null, "details": { "accountTypes": ["individual"], "signInMethods": ["password"], "signInWith": [], "accountStatus": "active" }, "detailsText": "account type individual; status active; sign-in methods password" }
  ],
  "linkedSocialLogins": ["Google"]
}

Output fields

Field	Meaning
email	The address, trimmed and lower-cased
valid	true on every row (entries that are not e-mail addresses are skipped, not output)
checkedAt	When the address was checked (UTC)
gravatar.exists	true = public Gravatar profile, false = none, null = Gravatar gave no clear answer
gravatar.status / gravatar.reason	found, not_found or unknown, and why when unknown
gravatar.profileUrl, displayName, username, fullName, avatarUrl	The public profile's identity fields
gravatar.location, aboutMe, jobTitle, company, pronouns	The profile's details, when the owner filled them in
gravatar.accounts / gravatar.accountsText	Social accounts on the profile (name, url, username, verified, label) and a one-line summary
gravatar.links, publicEmails, contactInfo	Links, e-mails and contact details the owner chose to publish
registeredOn / registeredOnText	Sites the address is registered on (list and one line)
registeredCount	How many sites said registered
notRegisteredOn	Sites that said the address is not registered
unknownOn	Sites that gave no clear answer this run (see siteResults for why)
checkedSites / answeredSites	Sites checked, and how many of them answered clearly
siteResults	One entry per site: site, status, reason, details (Adobe account type and sign-in methods, Duolingo linked logins, Bitmoji account type, WordPress e-mail verification) and detailsText (the same clues as one line of text)
linkedSocialLogins	Google / Facebook / Apple logins that Adobe or Duolingo report as linked to the address
footprintUrls	OSINT and breach-check links for the address (kind, name, url)

Three dataset views: Emails (one row per address: registrations, sites checked and answered, Gravatar yes/no), Per-site results (one row per address and site: the result, the account clues as text, and why when a site gave no clear answer) and Footprint and breach-check links (one clickable row per address and link).

Input

Field	Description
Emails	Addresses to investigate, one per line (up to 2,000 per run). A pasted list with commas or semicolons, or entries like Jane Doe <jane@example.com>, is split automatically.
Include OSINT footprint URLs	Recon and breach-check links (on by default).
Include adult (NSFW) sites	Also check the two adult sites in the table above, XNXX and XVideos (off by default).
Proxy configuration	The default (Apify Proxy) gives every request a fresh IP, which keeps per-IP rate limits away.

{ "emails": ["test@gmail.com", "name@company.com"] }

Use cases

• OSINT and investigations - fingerprint an address: registrations, public profile, breach leads.
• Fraud and account-risk checks - a sign-up address registered on many established services (and linked to Google or Facebook logins) behaves differently from a fresh throwaway.
• Lead and account enrichment - see whether a lead's address has real accounts and a public profile, and pick up the social links its owner published on Gravatar.

Related tools from scrapesage

• Sherlock Username Scraper and Maigret Username Scraper - find accounts by username (try the Gravatar username this Actor returns).
• PhoneInfoga Phone Number Scraper - the same kind of OSINT for phone numbers.
• Bulk Email Verifier - MX deliverability, disposable and role flags and typo fixes for a mailing list, a different job from this account-discovery Actor.

Use with AI assistants (MCP)

The output is clean, LLM-ready JSON. You can call this Actor from Claude, ChatGPT or any agent framework through the Apify MCP server - describe the data you need and let the assistant run this Actor for you. Pass emails and read the email records back.

Agent-ready: autonomous payments (x402 & Skyfire)

This actor is agent-ready: AI agents can discover it, run it, and pay for it autonomously, with no Apify account and no human in the loop. It uses pay-per-event pricing and limited permissions, so it qualifies for Apify's agentic-payment standards:

• x402: an open, HTTP-native payment protocol. Agents pay per run in USDC on the Base network directly through the Apify MCP server, with no account and no API key.
• Skyfire: agent-to-service payments for fully autonomous AI-agent workflows.

Building an AI agent, MCP tool, or autonomous data pipeline? This scraper is ready to plug in and pay as it goes.

How much does it cost?

This Actor uses Apify's pay-per-event pricing: you are charged for the emails it delivers, with no monthly rental. From 16 November 2026 each run also pays Apify's standard Actor Start fee, charged once per GB of run memory (a run at the default 1 GB pays it once). The events it can charge are:

• Email (titled "Email analysed" until 16 November 2026) - One email analysed: registration checks, Gravatar profile and OSINT footprint URLs. An email is charged only after at least one lookup answered for it.
• Actor Start (from 16 November 2026) - Charged when the Actor starts running. Number of events charged depends on Actor memory (one event per GB, minimum one event).

The current price of each event, and the prices that apply from 16 November 2026, are shown on the Pricing tab of this page. Set a maximum total charge on the run if you want a hard cap on spend, and use the input limits to control how much the Actor fetches.

Automate & schedule

Run this Actor on autopilot and pull results into your own stack:

• Apify API - start runs, fetch datasets and manage schedules over REST.
• apify-client for JavaScript and apify-client for Python - official SDKs.
• Schedules - run it hourly, daily or weekly and keep your dataset current.
• Webhooks - trigger downstream actions (CRM import, Slack alert, email sequence) the moment a run finishes.

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'MY_APIFY_TOKEN' });

const run = await client.actor('scrapesage/holehe-scraper').call({
    emails: ['test@gmail.com'],
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(`Got ${items.length} records`);

Integrate with any app

Connect the dataset to thousands of apps - no code required:

• Make - multi-step automation scenarios.
• Zapier - push new records straight into your CRM or spreadsheet.
• Slack - get notified when a scheduled run finds something new.
• Google Drive / Sheets - auto-export every run to a spreadsheet.
• Airbyte - pipe results into your data warehouse.
• GitHub - trigger runs from commits or releases.

FAQ

Does it need an API key or a login? No.

Why is a site unknown for some addresses? The site gave no clear answer this time: a rate limit, a refusal, a timeout, or the site calling the address invalid. The reason is in siteResults, and the run summary names the sites that did this. Re-running later usually turns them into clear answers.

Does the address owner find out? The checks use read-only "is this e-mail taken?" questions that sites answer during sign-up and sign-in. No account is created, no password reset is started and no e-mail is sent to the address.

Am I billed for addresses that are not valid? No. Entries that are not e-mail addresses are skipped and named on the run summary, and an address is billed only after at least one lookup answered for it. A run that stops at its maximum total charge or its time limit names the addresses it did not deliver. From 16 November 2026 each run also pays Apify's Actor Start fee once per GB of run memory, whatever its input.

Is this legal? It checks publicly observable signals and builds public search links. Use the results in line with each site's terms and applicable law, and see Data & lawful use below.

Data & lawful use

You supply the input (email addresses); the Actor only checks or enriches what you give it against publicly available sources. Make sure you collected that input lawfully and have a lawful basis to process it. This is a verification and open-source-intelligence tool for security research, fraud prevention and checking identifiers you are authorised to check. Do not use it to locate, track, profile or harass individuals, and follow the anti-spam and telemarketing rules that apply to you (for example GDPR and PECR in the EU and UK, CAN-SPAM and the TCPA in the US, CASL in Canada). Honour opt-outs and deletion requests.

Under Apify's Standard Actor Contract, which governs your use of this Actor, you are the controller of any personal data in your input and output and scrapesage acts only as your processor: that data is processed solely to run your job, written only to your own Apify storage, never used for any other purpose and never shared onward. If you need help with a data-subject request that involves this Actor's output, open an issue on the Issues tab.

Disclaimer

This Actor is an independent tool and is not affiliated with, endorsed by, or sponsored by the Holehe open-source project. All trademarks mentioned are the property of their respective owners.

"Holehe" is referenced only in a descriptive, nominative sense - to describe the kind of check this Actor performs. This Actor is an independent implementation, is not an official Holehe product and is not authorised or certified by the Holehe open-source project. It collects only publicly available information; you are responsible for ensuring your use of that data complies with applicable laws and regulations.

Need help?

Open an issue on the Actor's Issues tab, or visit the Apify help center. Feature requests are welcome - this Actor is actively maintained.