Skip to main content
Search underground forums and data-broker marketplaces for posts and listings where brokers advertise, trade, or dump leaked data — databases, credentials, and stolen records. Use it to find where a person, brand, or domain surfaces across the broker scene, whether it’s being offered for sale or already spilled. This search covers the broker sources that permit crawling, so their listings can be indexed ahead of time. Russian Market blocks automated access and can’t be indexed that way — search it with the live Data Broker Search instead. This source is asynchronous. You submit a search term, poll a task list until your term shows Completed, then read the full findings by task ID.
1

Submit

Post your search term to hf_search_request. The response returns the task id you poll on.
2

Poll

Call hf_search_results to list your tasks. Find the entry whose search_term matches what you submitted and wait until its status reads Completed.
3

Read

Once the task is Completed, fetch the full findings from retrieve_hacker_forum_task_results/{task_id} using the id from the submit step.

​
Request parameters

All three endpoints cost 0 credits. Submit and poll are throttled at 1000 requests per day each; the read endpoint allows 10000 per day.

​
What comes back

The poll call returns a paginated task list:
  • tasks — array of your search tasks.
    • id — task ID. Pass this to the read endpoint.
    • status — task state. Read findings once this is Completed.
    • created_at — when the task was submitted.
    • search_term — the term you submitted. Use it to match the right task.
    • served_link — link to the prepared result file, when available.
    • link_expire_date — when served_link stops working.
  • current_page — the page you are on.
  • total_pages — total pages of tasks.
The read call returns an array of findings, one object per match:
  • source — the forum or marketplace the post was found on.
  • date_scrapped — when the post was collected.
  • meta — post metadata (thread, author, and related context).
  • content — the post text matched by your term — a broker listing, sale offer, or data dump.
Each content block is the broker post or listing that named your search term. Pivot on the email, name, or domain inside it to confirm whether Acme records are being traded, then feed confirmed findings into your exposure and takedown workflows.