Skip to main content
Search leaked and for-sale payment cards by BIN, last 4, owner, and bank. Two paths sit behind this source: a synchronous index of cards recovered from leaks, and an asynchronous lookup of cards listed for sale on deep-web marketplaces. Use it to find exposed cardholder data tied to your BINs before the fraud lands.

​
Indexed leak cards (sync)

Cards recovered from indexed leaks return in a single call. Query by card number prefix, owner, or bank.
See the cc_leaks_search reference for the full schema.

​
Request parameters

​
What comes back

A paginated control envelope. content holds the card hits; number, size, totalElements, totalPages, numberOfElements, first, and last describe the page. A follow_up_token is attached for re-running the same search. Each item in content:
  • number — masked or recovered card number.
  • bank — issuing bank name.
  • owner — cardholder name.
  • cvv — card verification value, when present in the leak.
  • expireDate — expiry date (YYYY-MM-DD).
  • cvssScore — severity score for the finding.
  • leakId — UUID of the source leak.
  • leakName — name of the source leak.
  • leakPublishDate / leakDiscoverDate — when the leak was published and first seen.
  • leakSize — record count of the source leak.
  • leakTags — tags on the source leak.
  • id / createdAt — record ID and index timestamp.

​
Marketplace cards (async)

For-sale cards from deep-web marketplaces are collected asynchronously. Submit a lookup, poll for the task, then read the served result.
1

Submit

Submit a lookup by BIN, cardholder, location, vendor, or date range.
See the cc_search_request reference. The response carries a follow_up_token you reuse to track the task.
2

Poll

Poll the results endpoint until your task reports a completed status and a served_link.
See the cc_search_results reference.
3

Read

Read the task once status is complete. Each task carries a served_link to the result file and a link_expire_date after which the link is no longer valid.

​
Request parameters

Submit (cc_search_request) — every field is optional; combine the ones that narrow your target. Poll / Read (cc_search_results):

​
What comes back

cc_search_results returns a paginated list of your submitted tasks: tasks plus current_page and total_pages. Each task:
  • id — task ID.
  • status — task state; wait for completion before reading.
  • created_at — when the task was submitted.
  • search_term — the submitted query.
  • served_link — link to the result file once ready.
  • link_expire_date — when served_link stops working.
The result file behind served_link holds the marketplace card offers. Each offer carries the cleaned card facts (cleaned_bin, cleaned_type, cleaned_country, cleaned_state, cleaned_city, cleaned_zip, cleaned_expires, last_digits), the listing economics (offer_final_price_usd, stock, seller_rating, source_reputation), and flags for what extra data the offer bundles (offer_has_cvv, offer_has_ssn, offer_has_dob, offer_has_track1, offer_has_track2, offer_has_full_card_number).
Cross-reference recovered BINs and last 4 against your own card portfolio, then push confirmed exposures to your fraud team for reissue. Marketplace offers flagged with full card number, CVV, or track data are the highest-priority reissues.