> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The ULP feed

> The URL / Login / Password feed — searchable leaked credential triples from combolists and stealer logs.

**ULP** stands for **U**RL, **L**ogin, **P**assword — the three columns of a stolen-credential record: *where* it works, *who* it belongs to, and the *password* itself. [`accounts_database_search`](https://client-api.leak.center/scalar-docs/#tag/accounts/GET/service/accounts_database_search/) is the searchable index of those records. Every row is one leaked credential — a `login`, a `password`, and the `website` it opens — pulled from combolists and stealer logs and tagged with the leak it came from.

Unlike [Filtered credentials](/api/guides/credentials-filtered), this has **no domain restriction** — it's the right tool for a single address on a public domain (`jdoe@gmail.com`), or for searching by the website a credential was used on rather than by org.

### Search the account index

It's a Lucene query, just like [Raw Data](/api/guides/credentials-raw-sweep) — but the default field is `login`, and the fields are credential-shaped: `login`, `password`, `website`, `leakId`, `createdAt`. Combine with `AND`, `OR`, `NOT`.

| What you want                               | `query`                                            |
| ------------------------------------------- | -------------------------------------------------- |
| One identity's leaked credentials           | `jdoe@acme.com` (a bare term searches `login`)     |
| Everything used on your domain              | `website:acme.com`                                 |
| Who else used a given password (reuse hunt) | `password:Summer2026!`                             |
| Recent exposures on your domain             | `website:acme.com AND createdAt:[2026-01-01 TO *]` |

Send it as the `query` parameter (3–1024 characters). Because queries contain `:` and `[`, let `curl -G --data-urlencode` handle the encoding:

```bash theme={"dark"}
curl -G https://client-api.leak.center/api/service/accounts_database_search/ \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --data-urlencode 'query=website:acme.com'
```

Results are paginated with `page` and `size` (up to 100 a page) and sorted by `createdAt` descending — newest exposures first.

### Reading the results

A response is a page of credential rows. Searching `website:acme.com` here returns 19 hits — the first page:

```json theme={"dark"}
{
  "number": 0,
  "size": 10,
  "totalElements": 19,
  "totalPages": 2,
  "numberOfElements": 10,
  "first": true,
  "last": false,
  "hasContent": true,
  "content": [
    {
      "id": "cf2404d3-cd82-369a-b411-bd4c97ee6596",
      "createdAt": "2026-05-11 09:47:21",
      "login": "laura.brunner@acme.com",
      "password": "Summer2026!",
      "website": "https://acme.com/login",
      "leakId": "b2f4e833-2e12-3219-a2b1-84e39d59e194",
      "leakName": "url_login_pass_combolist_2026",
      "leakSize": 14412,
      "leakTags": "password,mix,email,url,account,username",
      "leakPublishDate": "2026-04-10",
      "leakDiscoverDate": "2026-05-10",
      "cvssScore": 7.0
    },
    {
      "id": "590fbcee-8efc-30c7-b581-0be31075cd77",
      "createdAt": "2026-05-11 09:47:21",
      "login": "billing@owa.acme.com",
      "password": "W3lcome#2025",
      "website": "https://acme.com/login",
      "leakId": "b2f4e833-2e12-3219-a2b1-84e39d59e194",
      "leakName": "url_login_pass_combolist_2026",
      "leakSize": 14412,
      "leakTags": "password,mix,email,url,account,username",
      "leakPublishDate": "2026-04-10",
      "leakDiscoverDate": "2026-05-10",
      "cvssScore": 7.0
    },
    {
      "id": "e6a2ee94-817c-3f57-8b05-d4bf45083c1b",
      "createdAt": "2026-05-11 09:47:21",
      "login": "m.garcia@rdp.acme.com",
      "password": "Tr0ub4dor&3",
      "website": "https://acme.com/login",
      "leakId": "b2f4e833-2e12-3219-a2b1-84e39d59e194",
      "leakName": "url_login_pass_combolist_2026",
      "leakSize": 14412,
      "leakTags": "password,mix,email,url,account,username",
      "leakPublishDate": "2026-04-10",
      "leakDiscoverDate": "2026-05-10",
      "cvssScore": 7.0
    },
    {
      "id": "26971582-21b1-39e5-9ecf-acae1e81b16b",
      "createdAt": "2026-05-11 09:47:21",
      "login": "j.fischer@mail.example",
      "password": "Tiger@2026",
      "website": "https://acme.com/login",
      "leakId": "b2f4e833-2e12-3219-a2b1-84e39d59e194",
      "leakName": "url_login_pass_combolist_2026",
      "leakSize": 14412,
      "leakTags": "password,mix,email,url,account,username",
      "leakPublishDate": "2026-04-10",
      "leakDiscoverDate": "2026-05-10",
      "cvssScore": 7.0
    }
  ]
}
```

Each row's fields:

* `login` / `password` — the credential. The password is in the clear here; some leaks carry a hash instead.
* `website` — the URL the credential was used on or captured from.
* `leakName`, `leakId`, `leakSize`, `leakTags` — the source leak (here a URL-login-password combolist — note `url` in the tags).
* `leakPublishDate` / `leakDiscoverDate` — when the leak surfaced, and when DarknetSearch found it.
* `cvssScore` — a severity rating for the source leak.
* `createdAt` — when this row was indexed; the default sort key.

<Info>
  **Read the three columns together.** `login` is the identity, `password` is in plaintext, and `website` is the exact surface the credential opens — here, every row points at `https://acme.com/login`, so that login page was harvested wholesale (a stealer log or URL-login-password combolist). Watch the logins for service give-aways: `owa.` is webmail, `rdp.` is remote desktop, a `vpn.` host is your VPN — each is an exposed front door, not just a mailbox. Because the passwords are in the clear, treat every row as a **working credential until it's rotated**.
</Info>

<Note>
  **When the credential came from a stealer log, there's more behind it.** The ULP feed shows you the one triple. If the row was harvested by info-stealer malware, the whole machine was emptied — other saved logins, live session cookies, a screenshot. [Stealer logs](/api/guides/credentials-stealer-logs) searches that corpus by infected machine and hands you the full capture.
</Note>

### Filter an org's breach feed instead

[`account_breaches`](https://client-api.leak.center/scalar-docs/#tag/leaks-analysis/GET/service/account_breaches/) is a second view of the same kind of data — scoped and filtered rather than free-text searched. Instead of a Lucene query it takes structured filters and returns `{count, results}` with `{leak_date, login, password, leak_source, website}` rows, **not deduplicated**.

Filter by any combination of:

* `website` — the domain (case-insensitive contains)
* `login` — an email address or username (case-insensitive contains)
* `password` — case-**sensitive** contains
* `leak_source` — the breach name
* `leak_date_after` / `leak_date_before` — a date range

```bash theme={"dark"}
curl "https://client-api.leak.center/api/service/account_breaches/?website=acme.com" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

Reach for `account_breaches` when you want a plain "every breach row for this domain, email, or password" feed with date and source filters; reach for `accounts_database_search` when you want the full Lucene query and the richer per-leak metadata.

### Aggregate the exposure

When you want totals instead of rows, pair the feed with Leaks Analysis:

* [`leaked_credentials_stats`](https://client-api.leak.center/scalar-docs/#tag/leaks-analysis/GET/service/leaked_credentials_stats/) — unique exposure counts, split by combolists vs. stealer logs
* [`top_risky_users`](https://client-api.leak.center/scalar-docs/#tag/leaks-analysis/GET/service/top_risky_users/) — the most-exposed accounts
* [`external_service_login_stealer_logs`](https://client-api.leak.center/scalar-docs/#tag/leaks-analysis/GET/service/external_service_login_stealer_logs/) — stealer-log exposure on external services