> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Find leaked credentials
> How DarknetSearch exposes leaked credentials — and which approach to reach for, by goal.
DarknetSearch collects leaked credentials from breaches, combolists, stealer logs, paste sites, and underground forums into one body of data — then exposes it four ways. There's no single "leaked credentials" endpoint, because the right call depends on what you intend to do with the result.
### The four approaches
* **Raw Data** — the leaked data in whatever form a threat actor packaged it: SQL dumps, JSON, CSV and Excel files, plain text, documents, combolists, and stealer logs. Nothing is parsed or stripped out — you search the original content full-text and triage it yourself.
* **The ULP feed** — the account index: the same leaks parsed into clean `login` / `password` / `website` triples you can query by field and pivot on, on any domain, including public mail.
* **Filtered credentials** — your organization's exposed accounts, for the domains you *own*: deduplicated, risk-scored, arranged by category, and kept current.
* **Stealer logs** — the same corpus searched by *infected machine* rather than by credential: each hit is a full stealer-log capture, with a bot record and screenshots you pull on demand.
The same leaked password can surface in all four — it's one body of data, shaped four ways. Choose by what you need to do with it: read the raw content, look an identity up, monitor what you own, or pull the whole capture off a compromised machine.
Directly downloading a leak file is a Raw Data companion workflow, not a separate credential source. Use it only for small original files under 10 MB; for normal investigation, search the indexed leak by `leakId`. See [Downloads and exports](/api/guides/downloads-exports).
### Which approach fits your goal
| Your goal | Approach | The API shape |
| ----------------------------------------------------------------------------------------------------------------- | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------- |
| Continuously watch **your own** organization's exposed accounts — deduplicated, risk-scored, prioritized | **Filtered credentials** | An async pipeline (`leak_filter_*`): create → poll → read, with risk scores and password-policy matching. Owned domains only. |
| Look up one identity, or pivot by login, website, or password — on **any** domain, including public mail | **The ULP feed** | One Lucene query (`accounts_database_search`) returning `login` / `password` / `website` rows. No domain restriction. |
| Investigate a leak in depth — read the **raw dump** and the data sitting around a credential | **Raw Data** | One full-text query (`leak_extended_database_search`) over unprocessed records. |
| Pull the **whole capture** off an infected machine — the bot record, screenshots, and everything the stealer took | **Stealer logs** | An async pipeline (`stealer_logs_search`): create → poll → read, then fetch each capture by its `botid_url`. Organization-scoped. |
Your owned domains, deduplicated and risk-scored — the ongoing, prioritized exposure list.
Field-queryable `login` / `password` / `website` lookups, on any domain including public mail.
The original leaked dump, searched full-text — the credential plus everything around it.
Search by infected machine — the full stealer-log capture, bot record, and screenshots.
### Still unsure? Follow the branches
* **Is it a domain you own, and you want an ongoing, prioritized exposure list?** Start with **Filtered credentials**. It's the only approach that deduplicates, scores, and tracks the delta over time — but it's scoped to domains you own, and public / very-high-volume domains are out of scope there.
* **Chasing a specific person, a reused password, or a login URL — possibly on a public mailbox?** Use **the ULP feed**. It's field-queryable (`login:`, `website:`, `password:`) and has no domain restriction, so it answers the lookups Filtered credentials can't.
* **Do you need more than the credential itself — the surrounding dump, PII, tokens, or proof of what was exposed?** Use **Raw Data**. It's the only approach that hands you the original leaked content, not just the parsed fields.
* **Is the credential from a stealer log, and do you need the whole machine — the screenshots, the session cookies, everything else that was on it?** Use **Stealer logs**. The other approaches flatten a stealer log into single credential rows; this one keeps the capture whole and hands you the bot record behind it.