Find leaked credentials

​

The five approaches

• Credential Check. A fast yes or no for one password, one email address, or one email and password pair. You call it from your own sign-up, login and password-change flows, and the answer comes back in the same response. No query syntax and nothing to poll.
• Raw Data. The leaked data in the form a threat actor packaged it: SQL dumps, JSON, CSV and Excel files, plain text, documents, combolists and stealer logs. Nothing is parsed or deduplicated. You search the original content full-text and triage it yourself.
• The ULP feed. The account index: the same leaks parsed into login / password / website rows that you query by field. It works on any domain, public mail providers included.
• Filtered credentials. The exposed accounts on one domain, typically your organization’s own: deduplicated, risk-scored and arranged by category. Later searches add only the leaks found since the last run.
• Stealer logs. The corpus searched by infected machine instead of by credential. Each hit leads to a full stealer-log capture, with a bot record and screenshots you fetch on demand.

​

Organization analytics

​

Which approach fits your goal

​

Still unsure? Follow the branches

• Do you need an answer while a user waits, at sign-up, login or a password change? Use Credential Check. It answers in one call, takes the raw value instead of a query, and works for addresses on any domain.
• Do you want a prioritized list of the exposed accounts on one domain, typically your organization’s own? Start with Filtered credentials. It is the only approach that deduplicates and scores accounts. Run the search again to pick up new leaks; each repeat run processes only the leaks found since the last one. To be notified instead of re-running it, create a monitor on the Leak Filter source. Very large domains, such as free-mail providers, are refused there.
• Chasing a specific person, a reused password or a login URL, possibly on a public mail provider? Use the ULP feed. It is field-queryable (login:, website:, password:) and has no domain restriction.
• Do you need more than the credential itself: the surrounding dump, other personal data, tokens, or proof of what was exposed? Use Raw Data. It is the only approach that searches the full text of every leaked file and returns the surrounding dump, not just the parsed fields.
• Did the credential come from a stealer log, and do you need the whole machine? Use Stealer logs. The other approaches flatten a stealer log into single credential rows. This one keeps the capture whole and gives you the bot record behind it.
• Do you need figures for a report or a dashboard? Use Organization analytics.

​

Availability and cost

{
  "detail": "Your license is not active."
}

​

Dashboard names

​

Endpoints