Recovers partial phone digits from the password-reset pages of services and builds candidate full numbers.
tools / holehe
holehe
Python CLI that checks whether an email address is registered on 120+ sites by abusing signup and password-recovery flows, without alerting the target.
our take
decent free option, lacks in sources and has false positives
field note
Run it from a VPN or VPS, not your home IP. Many modules get rate-limited after a few runs, so treat any "rate limit" result as unknown, not as a negative.
used in playbooks
similar tools
Web lookup for an email or phone that shows the linked Google account (name, photo, Maps reviews) and registrations on dozens of services.
Offensive Google framework that pulls the Gaia ID, profile photo, Maps reviews, public calendar, and linked services from a Gmail or Google Workspace address.
Browser-based OSINT search across 700+ modules. 400+ username platform checks, 330+ email enrichment modules, plus WHOIS, DNS and reverse-WHOIS for domains.
Commercial real-time lookup of an email, phone, or username across hundreds of modules, with linked accounts, names, photos, and a timeline view.
Fast username and email lookup across 600+ sites using the WhatsMyName dataset, with PDF/CSV export and optional AI-generated profile summaries.