> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Raw Data

> The widest, unprocessed view of the entire leak corpus — raw records of every shape.

**Raw Data** is the widest net into the leak corpus. [`leak_extended_database_search`](https://client-api.leak.center/scalar-docs/#tag/leaks/GET/service/leak_extended_database_search/) runs a full-text search across the entire indexed corpus and returns **one row per matching record** — so the same person or credential can appear many times, across many breaches. It is **not deduplicated**. This is the unprocessed feed.

<Info>
  **Why you'll see duplicates — and why that's useful.** Free leaks get repackaged endlessly: the same breach resurfaces under new names, rebundled into fresh combolists and reposted across forums and channels. So one credential showing up many times is expected, not a defect. Read it like an analyst — heavy duplication of a single leak means it's being actively recirculated and is in many hands, which tells you the exposure is widespread and still live. Deduplicate when you need a clean count; keep the duplicates when you're gauging how far something has spread.
</Info>

What comes back is the leaked content itself, in whatever form a threat actor packaged it. One search can surface any of:

* SQL dumps
* JSON exports
* CSV and Excel spreadsheets
* Plain-text files and documents
* Configuration files and logs
* Combolists (email-and-password pairs)
* Stealer-log captures

Each row carries the leaked payload in `content`. `fileName` and `fileExtension` tell you the format you're looking at, and `leakName`, `leakSource`, `leakSize`, and `leakPublishDate` describe the breach it came from.

**A raw record.** A response is a page of records — here, the first of 8,400-plus matches for `acme.com`:

```json theme={"dark"}
{
  "number": 0,
  "size": 10,
  "totalElements": 8421,
  "totalPages": 843,
  "numberOfElements": 10,
  "first": true,
  "last": false,
  "hasContent": true,
  "content": [
    {
      "id": "033109a7-666d-3985-bb09-9b0531bf5510",
      "createdAt": "2026-06-18 07:39:19",
      "content": "...,(4821,'jdoe','<kaduu:h>jdoe@acme.com</kaduu:h>','Summer2024!','198.51.100.23'),(4822,'asmith','<kaduu:h>asmith@acme.com</kaduu:h>','Pa$$w0rd!2024','198.51.100.51'),(4823,'mgarcia','<kaduu:h>mgarcia@acme.com</kaduu:h>','hunter2','198.51.100.77'),...",
      "fileName": "users_dump.sql",
      "fileExtension": "sql",
      "leakId": "1bb4d5fa-8910-37cd-8d91-56eff90665a1",
      "leakName": "Acme & partners (multiple domains affected) — csv sql json, cleaned by Kaduu",
      "leakSource": "darknet",
      "leakSize": 480857014,
      "leakTags": "password,private,csv,ip,name,email,hash,account,sql",
      "leakPublishDate": "2026-06-04",
      "leakDiscoverDate": "2026-06-05",
      "cvssScore": 10.0
    }
  ]
}
```

Two kinds of tags show up in that record, and they mean different things:

* **`<kaduu:h>…</kaduu:h>` inside `content`** marks where *your search term* matched. With `highlight=true` (quick search sets this automatically), every hit on your term is wrapped in these markers so you can find it in a wall of raw text.
* **`leakTags`** is an inventory of the *parent leak* — `password,email,ip,name,hash,sql` here — a fast read on what kinds of data the dump holds. It describes the whole leak, not the single row.

<Warning>
  **Don't stop at the highlight.** The `<kaduu:h>` markers tell you where your term landed — not the whole finding. The value is usually *next to* the match: above, the search hit the email, but the password, IP, and other PII sit right beside it, outside the tags. In a SQL or CSV dump there can be a lot of context on either side of the match — read the surrounding `content`, don't just grab the tagged term.
</Warning>

Search with **Lucene syntax** in the `query` parameter (3–1024 characters). The default field is `content`, so a bare term searches the leaked text itself; scope a term to a field with `fileExtension`, `fileName`, `leakId`, or `createdAt`, and combine terms with `AND`, `OR`, and `NOT`.

| What you want                                | `query`                                                          |
| -------------------------------------------- | ---------------------------------------------------------------- |
| Anything mentioning the domain               | `acme.com`                                                       |
| Email addresses on the domain                | `@acme.com`                                                      |
| SQL dumps for the domain, indexed since 2024 | `acme.com AND fileExtension:sql AND createdAt:[2024-01-01 TO *]` |
| The domain, excluding staging records        | `acme.com NOT staging`                                           |
| "admin" within 5 words of "password"         | `"admin password"~5`                                             |

A bare term matches the word or any token it's part of — `acme.com` hits `boss@acme.com`, `hr.acme.com`, and `super-acme.com` alike.

Write it out as a full request. Queries contain spaces and characters like `:` and `[`, so let `curl -G --data-urlencode` handle the encoding:

```bash theme={"dark"}
curl -G https://client-api.leak.center/api/service/leak_extended_database_search/ \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --data-urlencode 'query=acme.com AND fileExtension:sql AND createdAt:[2024-01-01 TO *]' \
  --data-urlencode 'size=50' \
  --data-urlencode 'page=0' \
  --data-urlencode 'highlight=true'
```

That resolves to a single URL:

```
https://client-api.leak.center/api/service/leak_extended_database_search/?query=acme.com%20AND%20fileExtension%3Asql%20AND%20createdAt%3A%5B2024-01-01%20TO%20%2A%5D&size=50&page=0&highlight=true
```

Control the volume with pagination: `size` (10–100, default 10) is how many records per page and `page` (0-based) walks through them — the envelope's `totalPages` and `last` tell you when to stop. `length` (1–1000, default 500) is a different lever: it sets how many characters of each matched `content` snippet come back — raise it when you need more surrounding context (see the warning above). `highlight=true` wraps matches in `<kaduu:h>` tags. Results return inline — no polling.

Raw Data has a companion view over the same leak corpus.

**Which breaches, and how heavily.** [`leak_simple_database_search`](https://client-api.leak.center/scalar-docs/#tag/leaks/GET/service/leak_simple_database_search/) rolls the matches up **by leak**: one row per breach your term appears in, each with a `resultCount` of how many records matched inside it, sorted by most matches first. It's the landscape view — instead of tens of thousands of raw rows, you see *which* breaches expose you and *how big* each hit is.

```json theme={"dark"}
{
  "number": 0,
  "size": 10,
  "totalElements": 992,
  "totalPages": 100,
  "numberOfElements": 10,
  "first": true,
  "last": false,
  "hasContent": true,
  "content": [
    {
      "id": "95cd9075-4752-3180-9627-a97faf8faea9",
      "createdAt": "2021-08-14 17:29:05",
      "leakName": "Collection 2024 (combined combolists)",
      "leakSource": "darknet",
      "leakSize": 575015352947,
      "leakTags": "password,email,hash,account",
      "leakPublishDate": "2019-01-30",
      "leakDiscoverDate": "2020-12-08",
      "cvssScore": 7.0,
      "resultCount": 88042
    },
    {
      "id": "210f3f7f-179e-31e9-b715-21c1a4ef7b10",
      "createdAt": "2022-11-22 21:53:37",
      "leakName": "Business contacts CSV 2024",
      "leakSource": "clearnet",
      "leakSize": 96793983147,
      "leakTags": "address,phone,name,json,email,url",
      "leakPublishDate": "2024-08-15",
      "leakDiscoverDate": "2024-09-01",
      "cvssScore": 4.0,
      "resultCount": 37921
    },
    {
      "id": "b6e9c3d5-2589-31f2-a3c3-e30c2241c7d8",
      "createdAt": "2026-02-20 10:04:44",
      "leakName": "Forum credential dump 02.2026",
      "leakSource": "darknet",
      "leakSize": 2772827485,
      "leakTags": "password,mix,email,username",
      "leakPublishDate": "2026-02-16",
      "leakDiscoverDate": "2026-02-20",
      "cvssScore": 0.0,
      "resultCount": 29537
    }
  ]
}
```

Each row is leak metadata — `leakName`, `leakSource`, `leakSize`, `leakTags`, `cvssScore`, `leakPublishDate` — plus `resultCount`. There's no `content`; to read the actual records from one breach, run a Raw Data search scoped to it with `leakId:<id>`.

<Info>
  **Need the original leak file or an export?** Direct leak-file downloads are only for small source files under 10 MB. For larger leaks, keep the investigation in Raw Data: search `leakId:<id>` to browse the indexed leak, or combine a keyword with `leakId:<id>` to search inside that one leak. See [Downloads and exports](/api/guides/downloads-exports) to choose between result-set exports and original leak-file downloads.
</Info>

Use Raw Data when you want everything and will triage it yourself.

<Note>
  **Chasing the stealer-log captures specifically?** Raw Data surfaces them as raw rows alongside everything else. To search the corpus *by infected machine* — and pull each capture's full bot record and screenshots — use [Stealer logs](/api/guides/credentials-stealer-logs) instead.
</Note>