Data breach detection across every kind of leak
Enter a domain. We search our collection of leaked records, full stealer logs and ransomware leak archives, wherever they were dumped, and show you the original record, why it matched and what to do next. What is being said, offered or prepared against you is a separate topic: dark web & forum monitoring.
10 leaks mention northwind-example.com: 1,910 matching records in 4 source types.
- Telegram dump: Login file shared in a channel. 5 matching, risk high (88 of 100). Original record: channel private, invite only, login k.lund@northwind-example.com, pass [redacted], file TXT, 5 lines, 2 new to us. Why it matched: 5 lines with @northwind-example.com logins in a file shared for free, 2 of them new to us.
- Stealer log: Infected laptop with a VPN login. 4 matching, risk critical (96 of 100). Original record: computer DESKTOP-NW-4F2K, ip 198.51.100.23, url vpn.northwind-example.com, login j.doe@northwind-example.com, pass [redacted]. Why it matched: A saved login for your VPN host, plus SSO session cookies less than a week old.
- Combo list: EU webmail combo list. 9 matching, risk low (34 of 100). Original record: login p.novak@northwind-example.com, pass [redacted], seen in 3 older leaks, valid est. 10–30% of the list. Why it matched: 9 company addresses. Most pairs are recycled from older leaks, one is new.
- SQL dump: Logistics SaaS database dump. 212 matching, risk medium (62 of 100). Original record: table users, email a.berg@northwind-example.com, hash [redacted], ref shipment references. Why it matched: 212 rows with company email addresses, from a supplier platform.
- Ransomware leak site: Leak of a logistics supplier, 41 GB. 214 matching, risk high (79 of 100). Original record: archive 41 GB · 5,389 files, folder /clients/Northwind/contracts, file staff-list-northwind.xlsx, mentions 214 files. Why it matched: Folders and files named after Northwind in the leaked file tree.
- Configuration file: Mail relay configuration. 2 matching, risk high (84 of 100). Original record: host mail.northwind-example.com, port 587, user relay@northwind-example.com, pass [redacted]. Why it matched: Your mail host and an SMTP login in a leaked configuration file.
- URL:login:password list: Mixed list, 2.6 GB. 17 matching, risk high (81 of 100). Original record: url sso.northwind-example.com/login, login m.keller@northwind-example.com, pass [redacted], novelty password new to us. Why it matched: 17 lines with @northwind-example.com logins, 4 of them with passwords we had not seen.
- Open cloud storage: Public storage bucket with an HR export. 38 matching, risk high (86 of 100). Original record: storage public, no login needed, file hr-export.csv, email k.lund@northwind-example.com, fields name, role, salary band. Why it matched: 38 rows with @northwind-example.com addresses in a file anyone can download.
- Open database: Open index with CRM leads. 1,406 matching, risk medium (55 of 100). Original record: index crm-leads, ip 203.0.113.40, email m.keller@northwind-example.com, fields name, role, phone. Why it matched: 1,406 lead records that name Northwind, stored in a vendor’s CRM.
- Documents: Supplier file share (PDF). 3 matching, risk high (74 of 100). Original record: file purchase-order-northwind.pdf, contact p.novak@northwind-example.com, iban [redacted], found in 3 of 3,912 files. Why it matched: 3 purchase orders mention northwind-example.com, with bank details.
Our breach collection of leaked records, updated with our average daily intake. Forum threads, channel posts and listings are not counted here.
One search, step by step.
Step 1 of 8: Pick what you know. Domain, email, name and 6 more
Fictional company and data. Passwords are shown as [redacted].
Where our data comes from, and why it holds up.
We collect every leak ourselves, then clean, de-duplicate and describe it before it reaches your search.
- 01Collected by people and machines
Analysts pick up leaks every day, wherever they are dumped; collectors and scrapers run around the clock.
- 02Every leak described
A written description, tags and three dates for every leak. Unverified seller claims are flagged as such.
- 03Cleaned, not just collected
Searchable fields, de-duplicated credentials, and an estimate of how much of a combo list is invalid.
- 04Fresh
Hundreds of new leak lists on a normal day. The newest upload is usually only minutes old.
- Size
- 2.6 GB
- Records
- 41.2M
- Accounts
- 38.9M
- Files
- 1
URL:login:password lines posted for free in a cybercrime Telegram channel. About a third is new to our collection. The poster’s claims are not independently verified.
We looked up the domain of a global pharmaceutical company on the same day in the public lookup of one of the largest infostealer intelligence vendors, and in DarknetSearch.
- Leaked records that name the domain
- Not covered
- 1,490,733SQL dumps, documents, logs, combo lists
Both lookups for the same domain on the same day, as shown on screen. The vendor’s paid product may show more than its public lookup. We do not name the company or the vendor.
Infostealers are one leak type
We also collect breaches, combo lists, SQL dumps, open databases and documents, and keep every record searchable.
Records, not rumours
This is leaked data. What is said or offered about a company, on forums, Telegram, Discord, paste sites and at data brokers, is covered separately.
Dark web & forum monitoring →Evidence, not counts
Every hit shows the original record, why it matched and how new it is, so you can act on it.
More leaks. Deeper detail. Searched your way.
Every kind of leak, collected every day
Breaches, combo lists, full stealer logs, SQL dumps, open databases, documents and ransomware leak files, wherever they were dumped.
The record, not just a breach name
See the leaked line itself, why it matched, how new it is, where else the password was used, and the infected computer behind it.
Search anything, your way
Domain, email, name, IP, card BIN, brand, password, file name or free text. With a query language, an API call behind every search and alerts from any query.
Sixteen sources, searched at once.
Every source can also be searched on its own, and every one has an API.
Leaked data 7
- Raw leaksSQL dumps, documents, configuration files and logs, with the original content.
- Filtered credentialsCredentials pulled from every leak and de-duplicated.
- Raw credentialsEvery credential line as found, without de-duplication.
- Stealer logsWhole infected computers: passwords, cookies, tokens, autofill, file tree.
- Credit cardsCards shared for free and cards offered for sale, by BIN or holder.
- Open cloud storageMisconfigured S3 and Azure storage and open databases.
- Ransomware leak filesThe contents of leaked archives: logins and the file tree.
Conversations and offers 5
- Data pastesPaste sites, where configs and samples often appear first.
- Data brokersWhat is for sale, which kind of data and when it was listed.
- TelegramCybercrime channels, mostly private and invite-only.
- DiscordServers where tools, logs and leaks are shared.
- Darknet chatterForum threads, re-checked for new replies.
In the same search, explained on their own page: dark web & forum monitoring →
Your brand on the open web 5
- SSL transparency logsNew certificates for your names.
- New domain registrationsLook-alike domains, found in new registrations.
- URL shortenersShort links that point to your sites or to fakes.
- Phishing referencesPhishing pages that copy your brand.
- App storesSpoofed apps that use your name.
Analysts pick up leaks every day, wherever they are dumped, and log every leak they add.
Scrapers and collectors run around the clock and pick up new dumps as they appear.
Hundreds of new leak lists and hundreds of millions of records arrive on a normal day.
One hit, taken apart.
This is what you see for every match. The example is fictional.
Matched on the login domain northwind-example.com, on a company VPN address.
- Type
- URL:login:password list
- Size
- 2.6 GB
- Records
- 41.2M
- Published
- 2 days ago
- Discovered
- same day
A fresh compilation, not a re-post: most lines are new to our collection. Expect a high share of working logins.
| vpn.northwind-example.com | j.doe@northwind-example.com | yesterday |
| login.streaming.example | j.doe@northwind-example.com | yesterday |
| webmail.example | jd.private@mail.example | 7 weeks ago |
Search anything. Automate everything.
There is no fixed list of search terms. Type what you are looking for, narrow it down, then turn it into an API call or a monitor.
northwind-example.com AND fileExtension:pdf AND fileName:invoiceInvoices as PDF that mention the domain"northwind" AND ("vpn" OR "citrix")Remote-access logins that name the company"payroll export"~5 AND northwindWords close to each other, in any leaked file
Every search has an API call
Next to every result: copy the exact request as JSON or cURL, for this source or for the whole search.
curl -H 'Authorization: Bearer <your-token>' \
'https://api.example/v1/search?source=raw-leaks&q=northwind-example.com'- Monitor from any queryOne click turns a search into a monitor for one source or all of them.
- Email or webhookYour own sender profile and template, or structured JSON to your SIEM or SOAR.
- Exclude preciselyExclude a password, a username, a server or an exact pair, so the same email with a new password still alerts.
From one domain to daily alerts.
- Minute 0Add your assetsDomains, mailboxes, IP ranges, brands, card BINs and keywords.
- Minutes laterSee what is already out thereOne baseline across 15 sources, with the exact query and how fresh each hit is.
- Every dayAlerts for what is newMonitors per source, by email or webhook. Exclude what you have handled.
- Every monthA report for managementCredential reports with trends, passwords masked if you like.
From breach alert to training, in one flow.
When an employee shows up in a breach, CyberFrog, our sister company, trains them on what actually leaked, and you see when they are done.
Free for every DarknetSearch client
- Your alert rules decideYou pick which DarknetSearch alert rules trigger training. Checked daily by default, or as often as every hour.
- Only your own peopleMatched by work email to your directory. New addresses only on your own domain, and only if you allow it.
- What actually leakedThe leak, its source, when it was first seen and the exact line. Passwords only as far as your privacy settings allow.
- Completion you can seeWho was notified, started and finished, in one ongoing campaign. No repeat lesson for the same kind of leak within 30 days by default.
- 1DarknetSearch alert
j.doe@northwind-example.comin a breach record, from your alert rule - 2Employee matched
Jamie Doe, Financeby work email, in your directory - 3Personal lesson
portal.northwind-example.comj.doe@… | [redacted]their record, about 8 min + quiz - 4Visible to your admin
Jamie Doe · completedquiz passed, in your results
Not just a leaked line. The whole infected computer.
A combo line tells you that a password leaked. A stealer log shows the computer behind it, so you know how bad it is and what to reset.
j.doe@northwind-example.com:[redacted]An email and a password. Nothing about where, when or what else.- Session cookiesFresh cookies open a session without password or MFA: revoke, don’t just reset.
- Everything on one device91 passwords on one laptop: company, suppliers, private.
- Export for forensicsOne computer as JSON, or all of them with one row each.
- Website
- https://vpn.northwind-example.com/login
- Login
- j.doe@northwind-example.com
- Password
- [redacted]
- Computer
- DESKTOP-NW-4F2K
- User
- jdoe
- IP
- 198.51.100.23
- Country
- Switzerland
- Infected
- 3 weeks ago
- Extracted
- 2 days later
- Path
- Downloads\invoice.exe
- Family
- Infostealer
- Confidence
- High
- Signals
- Vault dump, cookies
- vpn.northwind-example.com/login
- sso.northwind-example.com
- crm.saas-vendor.example
- mail.example
- Passwords.txt
- Cookies/
- Autofill/
- GoogleAccounts/
- System info.txt
- Screenshot.jpg
Fictional example. Passwords, cookies and tokens are never shown on this page.
What is said, offered or prepared is a separate view.
This page is about leaked records you can search and monitor. Forum threads, Telegram and Discord channels, paste sites, data broker shops and ransomware announcements are where attacks are planned and sold, often before anything leaks. They have their own page.
- Access sales, insider requests and data offers on forums
- Paste sites, Telegram, Discord and data broker shops
- Ransomware victim announcements as an early warning
Payment cards in leaks, and on the market.
Card data shows up in breaches, dumps and Telegram channels, and is listed for sale on dark web marketplaces. Card search and BIN monitors live in financial fraud monitoring.
- Free cards from dumps, breaches and Telegram channels
- Cards on sale from dark web marketplace listings
- Search by BIN range, last four or holder name, and monitor a BIN range
People and machines, every day.
- 1CollectAnalysts and collectors, every day
- 2ProcessNormalised, de-duplicated, described
- 3MatchYour assets, any identifier
- 4ExplainWhy it matched, how new, how risky
- 5AlertEmail or webhook, per source
- 6ReportExports, API, white-label reports
Card shop: new batch listed overnight
- nowChecking a card shop for new BINs
- 8 minLogged leak: logistics SaaS dump
- 14 minDownloaded free sample, 12 MB
Logged leak: HR portal export, 31k rows
- nowFound: HR portal export, 31k rows
- 4 minSearching an invite-only market by hand
- 14 minRequest: supplier name in a Discord server
Describing: HR portal export, 31k rows
- nowWeekly sector summary: healthcare
- 15 minReview step: description approved
- 19 minSetting dates: published, discovered, added
Mostly private and invite-only, some paid groups
- Private channel · combo lists43 new
- Invite-only · stealer logs18 new
- Paid group · databases10 new
- Private channel · access sales27 new
- Invite-only · card data15 new
Crawling a Russian-language sellers board
1,410 threads checked this hour
Next run in 03:47:11
Last run: 11 new listings, just now
- Victim post detectedDone
Logistics supplier (fictional) · posted 2 h ago
- Archive downloadedDone41 of 41 GB
- Files classifiedDone
5,389 of 5,389 files
- Emails 1,846
- Phone numbers 702
- IBANs 133
- Card numbers 41
- ID numbers 268
- File tree in the appDone
- finance/
- hr/
- contracts/
- it/
- 214 logins
You see what was taken without handling the stolen files.
People
- Analysts pick up leaks daily, wherever they are dumped
- Every leak is logged
- Manual investigations on request
Machines
- Scrapers and collectors, around the clock
- Dumps, shared files and leak archives unpacked and indexed
Not on this page
- What is said or offered about you: dark web & forum monitoring
Normalise
- AI turns dumps, logs and documents into fields
- Secrets such as API keys and tokens detected
De-duplicate
- Credentials from stealer logs, combo and URL:login:password lists
- Same server, user and password count once
Describe
- Description, tags and three dates per leak
- Combo lists: likely invalid share and real age
- Descriptions reviewed before publishing
Watch
- Ransomware leak sites monitored
- Victim announcements: an early warning, on dark web & forum monitoring
Extract
- Leaked archives downloaded
- Every file classified: emails, phones, bank and card numbers, IDs
Use
- Logins and the file tree in the app, no stolen files to handle
- Monitor yourself, your suppliers or a sector
Search, monitoring, reports, privacy and limits.
Identifiers
- Domain, email, name, IP, card BIN, brand, password, file name, host name
- Or any free text
Query language
- AND, OR, NOT, phrases, words near each other
- Fields: file type, file name, date, leak ID
API
- Copy any search as JSON or cURL
- Every source can be queried on its own
- Raw leak recordssearched: northwind-example.com48,212newest today
- Unique leaked credentialssearched: @northwind-example.com3,904newest today
- Organisation mailboxessearched: @northwind-example.com412newest 2 days ago
- Employees on private servicessearched: @northwind-example.com127newest 1 week ago
- Client and partner credentialssearched: northwind-example.com301newest 3 days ago
- TLS certificatessearched: *.northwind-example.com1,204newest today
- Public pastessearched: northwind-example.com37newest 4 days ago
- Ransomware leak sitessearched: Northwind12 weeks ago
Assets
- Domains, mailboxes, IP ranges, brands, card BINs, keywords
- A baseline across 15 sources before the first alert
Alerts
- Monitors per source
- Email with your sender profile and template, or webhook JSON
Exclusions
- Seen, false positive or former employee
- Any mix of password, username and server
Exports
- JSON, CSV or XLSX at any time
- Stealer logs: one row per computer
Reports
- White-label breach risk reports
- Monthly credential reports with trends, passwords full or masked
MSSPs
- A separate workspace per client
- Your branding on every report
No search history
- What you search is not stored
- Not in the app, not in server or API logs
Hosting
- All data hosted in Germany
Ethics
- Free leaks and samples of data on sale
- Purchases only on request, with explicit permission
Access
- Closed sources change; nobody can guarantee every source every day
Validity
- Unverified seller claims are flagged
- Combo lists come with an estimated invalid share
Display
- Up to 10,000 newest records per source; filters narrow it down
- Counts change every day
See what is out there about your company.
Check your domain for free: we count the leaked records that name it. Then start a free trial to see every record, set up monitors and run reports.