Email account enumeration: tools beyond Holehe check

Holehe is the standard entry point for this technique, covered in Step 03 of the Email OSINT guide: it checks roughly 120 platforms by analysing password-reset response behaviour. That module list has gaps. Regional platforms, niche forums, and services that have quietly changed their password-reset flow since a Holehe module was last updated will not show up in a Holehe run, whether or not the address is registered there.

This guide covers three free tools that extend coverage past Holehe: one that checks thousands of sites by username rather than password-reset behaviour, one that layers a second independent site list on top for cross-checking, and one built specifically to pull Google account data from a Gmail address. Use them when a Holehe run comes back thinner than expected, or when a Holehe positive needs a second, independent confirmation before it goes into a case file.

The following tools are used across the steps below. All are free unless noted.

Maigret: Open-source, MIT-licensed username search tool that checks a handle against 3,000+ sites and extracts profile metadata such as name, avatar, and location where available. No account or API key required. Free. Requires Python.

Blackbird: Open-source username and email search tool covering 600+ platforms, with metadata extraction and WhatsMyName-compatible checks in one pass. Free. Requires Python. Command line.

GHunt: Open-source, AGPL-licensed tool purpose-built for Gmail addresses. Reveals activated Google services, a linked YouTube channel, Google Maps review history, and the account's Gaia ID. Authenticates using the investigator's own Google session via a browser extension, not the target's account. Free. More setup than a password-reset check.

Tool disagreement mistaken for confirmation: Running four tools and getting a hit from just one does not mean the others "missed" a real account; each tool covers a different platform list and uses different detection logic, so a single hit is a lead, not corroboration. Verifying check: Require at least one additional signal, a second tool, a manual platform check, or metadata matching known facts, before treating any single-tool hit as confirmed.

Stale tool databases: Maigret's and Blackbird's site lists are community-maintained and can lag behind platform changes; a listed site may have changed its response behaviour or URL structure since the last update, producing false negatives that look like a clean account map. Verifying check: For any platform material to the investigation, manually visit it and confirm current behaviour rather than relying solely on tool output.

GHunt data staleness and privacy settings: GHunt's output depends entirely on what the account holder has made visible through Google's own privacy controls; a well-configured account will return minimal data even if heavily used. Verifying check: Treat a thin GHunt result as inconclusive, not as confirmation the account does not exist or is dormant.

Recursive discovery over-attribution: Maigret's recursive mode automatically searches for usernames it extracts from discovered profiles, which can chain into accounts belonging to a different person who happens to share a display name or handle fragment. Verifying check: Manually review any account surfaced through recursive discovery before adding it to the map; do not accept it on the strength of the automated chain alone.

Chain of custody: Enumeration results are as time-sensitive as the accounts they describe. Platforms change privacy defaults, accounts are deleted, and tool databases update on their own schedules.