Holehe Email OSINT Scraper - Find Accounts by Email

Investigate an email address the way Holehe does. For each email you get:

• Site registrations - whether the email is registered on a validated set of sites (checked live).
• Gravatar profile - if the email has a Gravatar, its profile URL, display name and any linked accounts.
• OSINT footprint URLs - ready-made Google dorks, social searches, and breach-check links (Have I Been Pwned, DeHashed, Intelligence X).

One rich record per email. No login, no API key.

A note on coverage (read this)

Email-registration enumeration has been deliberately hardened across the industry - most sites that once leaked "this email is registered" have closed that hole. So this Actor does not pretend to check 120 sites: it runs a curated, live-validated set of checks that genuinely still work, and is honest about the rest. The Gravatar lookup and the footprint / breach-check URLs always work and are where most of the OSINT value is. This is the realistic state of email OSINT in 2026.

Example output

{
  "type": "email",
  "email": "matt@mullenweg.com",
  "valid": true,
  "gravatar": {
    "exists": true,
    "profileUrl": "https://gravatar.com/...",
    "displayName": "Matt",
    "accounts": [{ "name": "wordpress", "url": "https://profiles.wordpress.org/..." }]
  },
  "registeredOn": ["WordPress.com", "Duolingo", "Firefox"],
  "registeredCount": 3,
  "checkedSites": 4,
  "footprintUrls": [
    { "kind": "breach", "name": "Have I Been Pwned", "url": "https://haveibeenpwned.com/account/matt%40mullenweg.com" },
    { "kind": "google", "name": "Google exact", "url": "https://www.google.com/search?q=%22matt%40mullenweg.com%22" }
  ]
}

Field	Meaning
valid	Whether the address is syntactically a valid email
gravatar	Gravatar profile (exists, profile URL, display name, linked accounts)
registeredOn	Sites the email is registered on (empty if none found)
registeredCount / checkedSites	How many of the checked sites matched
footprintUrls	OSINT recon + breach-check URLs for the email

Input

Field	Description
Emails	Email addresses to investigate (up to 2,000).
Include OSINT footprint URLs	Generate recon & breach-check URLs (on by default).
Include adult (NSFW) sites	Include adult sites in the registration checks (off by default).
Proxy	Residential proxies reduce rate-limiting.

Use cases

• OSINT & investigations - fingerprint an email: profile, registrations, breach leads.
• Lead & account enrichment - see whether a lead's email has real accounts and a public profile.
• Fraud / due diligence - check an address against Gravatar and breach directories in one step.

Sibling actors

Pair this with Sherlock / Maigret username scrapers (accounts by username) and the PhoneInfoga phone scraper (numbers) for full OSINT coverage across handle, email and phone. For mailbox deliverability (MX, disposable, role, catch-all) see our Bulk Email Verifier - a different job from this account-discovery Actor.

Run it from an agent (MCP / API)

Agent-ready: typed input schema, structured JSON output. An agent can call this Actor to enrich or investigate an email in one step. Pass emails and read the email records back.

FAQ

Does it need an API key? No. Why so few checked sites? Because email-registration enumeration is mostly closed now - this Actor only runs checks that still work, rather than reporting hundreds of dead ones. Gravatar + footprint carry the value. Is this legal? It checks publicly observable signals and builds public search links. Use the results in line with each site's terms and applicable law.