Skip to main content
DarknetSearch collects leaked credentials from breaches, combolists, stealer logs, paste sites, and underground forums into one body of data — then exposes it four ways. There’s no single “leaked credentials” endpoint, because the right call depends on what you intend to do with the result.

​
The four approaches

  • Raw Data — the leaked data in whatever form a threat actor packaged it: SQL dumps, JSON, CSV and Excel files, plain text, documents, combolists, and stealer logs. Nothing is parsed or stripped out — you search the original content full-text and triage it yourself.
  • The ULP feed — the account index: the same leaks parsed into clean login / password / website triples you can query by field and pivot on, on any domain, including public mail.
  • Filtered credentials — your organization’s exposed accounts, for the domains you own: deduplicated, risk-scored, arranged by category, and kept current.
  • Stealer logs — the same corpus searched by infected machine rather than by credential: each hit is a full stealer-log capture, with a bot record and screenshots you pull on demand.
The same leaked password can surface in all four — it’s one body of data, shaped four ways. Choose by what you need to do with it: read the raw content, look an identity up, monitor what you own, or pull the whole capture off a compromised machine.
Directly downloading a leak file is a Raw Data companion workflow, not a separate credential source. Use it only for small original files under 10 MB; for normal investigation, search the indexed leak by leakId. See Downloads and exports.

​
Which approach fits your goal

Filtered credentials

Your owned domains, deduplicated and risk-scored — the ongoing, prioritized exposure list.

The ULP feed

Field-queryable login / password / website lookups, on any domain including public mail.

Raw Data

The original leaked dump, searched full-text — the credential plus everything around it.

Stealer logs

Search by infected machine — the full stealer-log capture, bot record, and screenshots.

​
Still unsure? Follow the branches

  • Is it a domain you own, and you want an ongoing, prioritized exposure list? Start with Filtered credentials. It’s the only approach that deduplicates, scores, and tracks the delta over time — but it’s scoped to domains you own, and public / very-high-volume domains are out of scope there.
  • Chasing a specific person, a reused password, or a login URL — possibly on a public mailbox? Use the ULP feed. It’s field-queryable (login:, website:, password:) and has no domain restriction, so it answers the lookups Filtered credentials can’t.
  • Do you need more than the credential itself — the surrounding dump, PII, tokens, or proof of what was exposed? Use Raw Data. It’s the only approach that hands you the original leaked content, not just the parsed fields.
  • Is the credential from a stealer log, and do you need the whole machine — the screenshots, the session cookies, everything else that was on it? Use Stealer logs. The other approaches flatten a stealer log into single credential rows; this one keeps the capture whole and hands you the bot record behind it.