Holehe Email OSINT Scraper - Find Accounts by Email

Disclaimer: This Actor is an independent tool and is not affiliated with, endorsed by, or sponsored by the Holehe open-source project. All trademarks mentioned are the property of their respective owners. "Holehe" is referenced only to describe the kind of check this Actor performs.

Investigate an email address the way Holehe does. For each email you get:

• Site registrations - whether the email is registered on a validated set of sites (checked live).
• Gravatar profile - if the email has a Gravatar, its profile URL, display name and any linked accounts.
• OSINT footprint URLs - ready-made Google dorks, social searches, and breach-check links (Have I Been Pwned, DeHashed, Intelligence X).

One rich record per email. No login, no API key.

A note on coverage (read this)

Email-registration enumeration has been deliberately hardened across the industry - most sites that once leaked "this email is registered" have closed that hole. So this Actor does not pretend to check 120 sites: it runs a curated, live-validated set of checks that genuinely still work, and is honest about the rest. The Gravatar lookup and the footprint / breach-check URLs always work and are where most of the OSINT value is. This is the realistic state of email OSINT in 2026.

Example output

{
  "type": "email",
  "email": "matt@mullenweg.com",
  "valid": true,
  "gravatar": {
    "exists": true,
    "profileUrl": "https://gravatar.com/...",
    "displayName": "Matt",
    "accounts": [{ "name": "wordpress", "url": "https://profiles.wordpress.org/..." }]
  },
  "registeredOn": ["WordPress.com", "Duolingo", "Firefox"],
  "registeredCount": 3,
  "checkedSites": 4,
  "footprintUrls": [
    { "kind": "breach", "name": "Have I Been Pwned", "url": "https://haveibeenpwned.com/account/matt%40mullenweg.com" },
    { "kind": "google", "name": "Google exact", "url": "https://www.google.com/search?q=%22matt%40mullenweg.com%22" }
  ]
}

Field	Meaning
valid	Whether the address is syntactically a valid email
gravatar	Gravatar profile (exists, profile URL, display name, linked accounts)
registeredOn	Sites the email is registered on (empty if none found)
registeredCount / checkedSites	How many of the checked sites matched
footprintUrls	OSINT recon + breach-check URLs for the email

Input

Field	Description
Emails	Email addresses to investigate (up to 2,000).
Include OSINT footprint URLs	Generate recon & breach-check URLs (on by default).
Include adult (NSFW) sites	Include adult sites in the registration checks (off by default).
Proxy	Residential proxies reduce rate-limiting.

Use cases

• OSINT & investigations - fingerprint an email: profile, registrations, breach leads.
• Lead & account enrichment - see whether a lead's email has real accounts and a public profile.
• Fraud / due diligence - check an address against Gravatar and breach directories in one step.

Sibling actors

Pair this with Sherlock / Maigret username scrapers (accounts by username) and the PhoneInfoga phone scraper (numbers) for full OSINT coverage across handle, email and phone. For mailbox deliverability (MX, disposable, role, catch-all) see our Bulk Email Verifier - a different job from this account-discovery Actor.

Run it from an agent (MCP / API)

Agent-ready: typed input schema, structured JSON output. An agent can call this Actor to enrich or investigate an email in one step. Pass emails and read the email records back.

Agent-ready: autonomous payments (x402 & Skyfire)

This actor is agent-ready — AI agents can discover it, run it, and pay for it autonomously, with no Apify account and no human in the loop. It uses pay-per-event pricing and limited permissions, so it qualifies for Apify's agentic-payment standards:

• x402 — an open, HTTP-native payment protocol. Agents pay per run in USDC on the Base network directly through the Apify MCP server — no account, no API key.
• Skyfire — agent-to-service payments for fully autonomous AI-agent workflows.

Building an AI agent, MCP tool, or autonomous data pipeline? This scraper is ready to plug in and pay as it goes.

How much does it cost?

This Actor uses Apify's pay-per-event pricing: you are charged only for the results it delivers, with no monthly rental and no start fee. The events it can charge are:

• Email analysed - One email analysed: registration checks, Gravatar profile and OSINT footprint URLs

The current price of each event is shown on the Pricing tab of this page. Set a maximum total charge on the run if you want a hard cap on spend, and use the input limits to control how much the Actor fetches.

Automate & schedule

Run this Actor on autopilot and pull results into your own stack:

• Apify API - start runs, fetch datasets and manage schedules over REST.
• apify-client for JavaScript and apify-client for Python - official SDKs.
• Schedules - run it hourly, daily or weekly and keep your dataset current.
• Webhooks - trigger downstream actions (CRM import, Slack alert, email sequence) the moment a run finishes.

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'MY_APIFY_TOKEN' });

const run = await client.actor('scrapesage/holehe-scraper').call({
    // your input - see the Input section above
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(`Got ${items.length} records`);

Integrate with any app

Connect the dataset to thousands of apps - no code required:

• Make - multi-step automation scenarios.
• Zapier - push new records straight into your CRM or spreadsheet.
• Slack - get notified when a scheduled run finds something new.
• Google Drive / Sheets - auto-export every run to a spreadsheet.
• Airbyte - pipe results into your data warehouse.
• GitHub - trigger runs from commits or releases.

FAQ

Does it need an API key? No. Why so few checked sites? Because email-registration enumeration is mostly closed now - this Actor only runs checks that still work, rather than reporting hundreds of dead ones. Gravatar + footprint carry the value. Is this legal? It checks publicly observable signals and builds public search links. Use the results in line with each site's terms and applicable law.

Data & lawful use

You supply the input (email addresses); the Actor only checks or enriches what you give it against publicly available sources. Make sure you collected that input lawfully and have a lawful basis to process it. This is a verification and open-source-intelligence tool for security research, fraud prevention and checking identifiers you are authorised to check. Do not use it to locate, track, profile or harass individuals, and follow the anti-spam and telemarketing rules that apply to you (for example GDPR and PECR in the EU and UK, CAN-SPAM and the TCPA in the US, CASL in Canada). Honour opt-outs and deletion requests.

Under Apify's Standard Actor Contract, which governs your use of this Actor, you are the controller of any personal data in your input and output and scrapesage acts only as your processor: that data is processed solely to run your job, written only to your own Apify storage, never used for any other purpose and never shared onward. If you need help with a data-subject request that involves this Actor's output, open an issue on the Issues tab.

Disclaimer

This Actor is an independent tool and is not affiliated with, endorsed by, or sponsored by the Holehe open-source project. All trademarks mentioned are the property of their respective owners.

"Holehe" is referenced only in a descriptive, nominative sense - to describe the kind of check this Actor performs. This Actor is an independent implementation, is not an official Holehe product and is not authorised or certified by the Holehe open-source project. It collects only publicly available information; you are responsible for ensuring your use of that data complies with applicable laws and regulations.

Need help?

Open an issue on the Actor's Issues tab, or visit the Apify help center. Feature requests are welcome - this Actor is actively maintained.