Getting Started

Search for domain-wide compromises and intelligence

1Pick a language

2Credentials

Get API Key

Header

3Try It!

subdomains

array of strings

length ≤ 5

🔍 Subdomain filters to match against subdomains in the URL field. Maximum 5 items allowed. ⚠️ Cannot be used together with 'keywords' or 'keywords_match' parameters - these are mutually exclusive filtering options.

subdomains

sort_by

string

enum

Defaults to date_compromised

Field to sort results by. 'date_compromised' sorts by when the infection occurred, while 'date_uploaded' sorts by when the data was integrated into our platform.

Allowed:

sort_direction

string

enum

Defaults to desc

Direction to sort results. 'desc' returns newest records first (recommended for monitoring), while 'asc' returns oldest records first (useful for historical analysis).

Allowed:

types

array of strings

Filter results by credential type. 'employees' returns corporate email credentials (@company.com), 'users' returns consumer credentials, and 'third_parties' returns credentials from related domains (only available when 'domains' parameter is provided).

types

Allowed:

keywords

array of strings

Filter results to URLs containing specified keywords. Useful for finding credentials for specific services (e.g., ['vpn', 'admin', 'portal']). Case-insensitive matching. Maximum 10 keywords per request.

keywords

keywords_match

string

enum

Defaults to any

Determines how multiple keywords are matched. 'any' returns results matching at least one keyword (broader results), while 'all' requires all keywords to match (narrower, more specific results).

Allowed:

filter_credentials

boolean

Defaults to true

Controls credential filtering in results. When true, returns only credentials matching the search criteria. When false, returns all credentials from matching stealers, which may include credentials for unrelated domains/services.

cursor

string

Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the 'nextCursor' field in the previous response. Provides more reliable pagination than offset-based approaches.

start_date

date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter results from this date/time onward. Applies to the field specified in 'sort_by'. Useful for incremental data retrieval and monitoring.

end_date

date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter results up to this date/time. Applies to the field specified in 'sort_by'. Useful for historical analysis and limiting result timeframes.

additional_fields

array of strings

Defaults to []

Optional additional data to include in results. 'search_data' adds information about the search terms found in the browsing history search engine results from infected devices. 'installed_software' adds information about software installed on compromised machines, useful for vulnerability assessment and attack surface analysis. 'employee_session_cookies' adds session cookies from employee credentials, useful for identifying active sessions and potential unauthorized access. May increase response size and processing time. 'password_strength' adds password strength analysis for each password in the results. 'sensitive_applications' adds information about sensitive applications within the compromised URL structure, based on a predefined list of sensitive apps. 'dir_tree' adds information about the directory tree of the compromised machine, which can help identify potential attack vectors.

additional_fields

Allowed:

Loading…