Credential and stealer log monitoring for passwords, sessions and identities
We collect credentials wherever they leak, from full stealer logs to ransomware leaks, and show each password, cookie and token with its source, its age and its risk.
- 4 Own systems
- 2 Work SaaS
- 3 Private
- vpn.northwind.example: Active credential risk. The saved VPN login. Captured three weeks ago, so it may still work.
- git.northwind.example: Active credential risk. A personal access token for the code server.
- console.cloud.example: Active credential risk. A cloud console login with an admin role.
- sso.northwind.example: Session risk. A session cookie for the company sign-in: while it is valid, it opens the session without password or MFA.
- mail.northwind.example: Session risk. Web mail with a saved password and a live session cookie.
- crm-saas.example: Session risk. The company CRM in the cloud, signed in with a work account.
- social.example: Session risk. A private social account, still signed in.
- bank.example: Endpoint compromise evidence. Online banking: the user name and card hints from autofill.
- shop.example: Historical identity exposure. A private shop account that reuses the VPN password.
- leak sources in one search
- 6
- credential views
- 7
- novelty and risk per credential
- 0–10
- typical time for a comparison report
- 15 min
A stealer infection is not a password leak. It is a snapshot of a digital identity.
An infostealer infects one computer and extracts the identity stored in its browsers and apps. Depending on the malware family and its configuration, that can include all of this:
- Passwords
- Cookies
- Session tokens
- Autofill
- Browser history
- Crypto wallets
- App logins
- Local files
- System details
Common familiesRedLine · Lumma · Vidar · Raccoon · Stealc · RhadamanthysThe trade is industrialised: criminals sell complete stealer packages, not single passwords.
- 13.2Mnew infections
- 642Mcredentials, about 50 per infection
- 8.6Bstolen cookies
- 27saved logins on a typical infected machine; some hold hundreds
Passwords are only half the story. Sessions are the other half.
Stealers take browser cookies and authentication tokens. With a live session an attacker may not need the password at all, and MFA does not stop them. That changes how you clean up.
- Cookies are identity assetsIndustry reports count billions of stolen cookies a year; session artifacts are among the most valuable things criminals trade.
- We show themOur API returns optional session-cookie data next to passwords, machine details, installed software, browsing and directory information.
Passwords, sessions and identities, not just breached credentials.
- 1Reset the password
- 2Investigate
- 3Enforce MFA
- 1Revoke sessions and tokens
- 2Reset the credential
- 3Investigate the device
- 4Re-enrol MFA if needed
Ahead of the leader at its own game, and far beyond logins.
Hudson Rock calls its platform “powered by the world’s most comprehensive compromised credentials database”. To show where we stand, we put its public lookup next to our data for four domains, on the same day.
- 28×as many credentialsEvery source
- +43%more infected computersStealer logs, Hudson Rock’s own game
- 6.1 millionleaked records, 599× the 10,246 credentials in Hudson Rock’s lookupWhole datasets on the four domains. Ours includes every stealer log, plus dumps, documents, emails and configs.
- Livestealer trafficLogs as they are sold, not only recycled ones. Not part of the public lookup. See it
DarknetSearch: every credential for the domain in our collection: stealer logs, URL:login:password lists (almost all of them stealer-log lines shared without the machine and its cookies), breaches, combo lists and other leaks. A machine that only visited the domain counts as a computer, not as a credential. Hudson Rock describes itself as focused exclusively on infostealers; its figure is the credential count stated in its public lookup’s analysis text, which that text dates to April 2026.
| Domain | Hudson Rock, public lookup | DarknetSearch | Difference |
|---|---|---|---|
| mattel. | 4,898 | 64,844 | 13× |
| morganstanley. | 2,375 | 84,231 | 35× |
| harley-davidson. | 2,570 | 50,752 | 20× |
| merck. | 403 | 86,410 | 214× |
Hudson Rock, public lookup: 5 November 2026, 19:48–19:50 UTCDarknetSearch: 5 November 2026, 18:59–20:10 UTC
- Hudson Rock: the counts its public domain lookup showed on the capture date; the lookup states they come from Hudson Rock’s Cavalier data. Infected computers are its compromised employees plus compromised users, from the lookup’s current tiles; its credential figure comes from the analysis text on the same page, dated there April 2026. All leaked data: Hudson Rock’s side is everything its lookup counts, its credentials; it shows no other leaked data.
- DarknetSearch: our dashboard on the same day, de-duplicated (one machine counted once, the same site, user and password counted once). Infected computers come from stealer logs; credentials and raw records from every source.
- Totals: the four domains added up; the difference is our figure divided by Hudson Rock’s.
- Hudson Rock’s paid products may show more than its public lookup. Both collections grow daily, so figures change. Screenshots of both sides are archived.
- We show every domain we ran on both sides, whatever the result.
- Hudson Rock and Cavalier are names of their owner and are used here for identification only.
Malware is one way to steal an identity. Phishing is another.
An attacker does not need malware. Adversary-in-the-middle phishing kits proxy the real sign-in: the victim types the real password, completes MFA, and the kit keeps the session that comes out of it.
28.6Mphishing-derived identity records in one year of industry data, 49% of them corporate users
Incident responders also see attackers call staff, send them to a fake sign-in page for the company SSO, collect passwords and MFA codes, then take over SaaS apps and extort the company.
- Victim
- Fake sign-in pageproxies every step
- Real sign-in
- 1Password
- 2MFA response
- 3Session cookie
- 4Refresh token
The attacker signs in with the stolen session: no password, no MFA prompt.
So a vendor that says “we monitor stealer logs, so we monitor compromised identities” describes one way identities are stolen. Malware is not phishing, and neither covers breached databases. We collect the other routes too: breaches, open databases, combo lists, ransomware leaks, and the forums and channels where stolen logins are traded.
A ULP line is a clue. The full log is the evidence.
ULP means URL, login and password. It is useful at once because it names the target service, but it was usually parsed out of something bigger. Once a log is cut into ULP lines, most of its context is gone.
privateHQfreshlivepremiumfirst-handrawC2 logs
Sellers use words like these for material close to the source. No industry standard defines them. What counts: we ingest live stealer traffic too, not only collections recycled through public channels.
https://vpn.northwind.example : j.doe@northwind.example : [redacted]- Machine identity
- OS and version
- Host name
- Infection date
- IP and location
- Browser profiles
- Saved passwords
- Visited URLs
- Cookies
- Tokens
- Autofill
- Installed apps
- Directory tree
- Files
- Infection path
One breached service, many users.
Traditional breaches remain a huge source of credentials. A compromised application database exposes one service across many users; a stealer exposes one person across many services.
email | username | bcrypt_hash | first_name | phone | birth_date | addressemail | plaintext_passwordWhere we get them: SQL dumps and database breaches from hacker forums, markets and threat actor sites, kept as the original records. Every leak gets a description, tags and three dates.
The question it answersWhich identities from our organisation appeared in compromised external services?
The question it answersWhich compromised person or device may give access to us right now?
Not every leak needs a hacker. Some are simply left open.
Publicly reachable databases and storage are a category of their own. A credential found in an open Elasticsearch index may have leaked through a misconfiguration, not through malware.
Provenance changes the response: an open server needs closing and its keys rotating; a stolen credential needs its device investigated.
Misconfigurations and weak or missing credentials remain among the main causes of cloud compromises.
Where we get them: exposed databases and misconfigured S3 and Azure storage, indexed as raw data together with the server they came from.
- Elasticsearch
- MongoDB
- PostgreSQL backups
- S3-compatible storage
- Firebase databases
- Git repositories
- Configuration backups
- Debug endpoints
- Credentials and hashes
- API keys
- Connection strings
- Session material
- Customer data
- Internal configuration
Five sightings, often one compromise.
A combo list is an aggregated list of email:password or username:password pairs with little or no provenance. It mixes old breaches, cracked hashes, stealer logs, phishing results and earlier lists.
51%of the records in analysed underground combo lists overlapped with earlier infostealer data (industry report)
Where we get them: forums, Telegram channels and paste sites. We de-duplicate them (the same server, user name and password count once) and estimate how much of a list is invalid.
- Breach A
- Combo list A
- Telegram archive
- Combo list B
- Market dump
- Mega collection
1 original compromise
The same credential travels through all of them. Five sightings may be one original compromise, not five incidents.
What we keep for every credential- First seen
- Last seen
- Source type
- Original compromise date, when known
- Redistribution date
After the breach, and beyond the victim.
Credentials in ransomware and extortion leaks come from a later stage of an attack: the organisation was already compromised. That makes them a different kind of intelligence.
- Stealer credentialpossibly a warning before a compromise
- Ransomware leak credentialusually intelligence after a compromise
That is why we look inside the leaks instead of only watching for your name on leak sites. Our own tooling downloads every leak published on ransomware sites, classifies each file and extracts the identities in it.
Ransomware hits company A and publishes a spreadsheet with the VPN logins of its supplier, company B. Company B was never attacked, but its credentials are now out.
What a ransomware leak can hold- Configuration files
- VPN credentials
- Password spreadsheets
- Browser exports
- Database backups
- Directory data
- Source code secrets
- Cloud keys
- Customer credentials
Secrets are credentials too.
Credential monitoring today covers far more than user names and passwords. These turn up in stealer logs, open databases, ransomware leaks and public code:
- API keys
- OAuth tokens
- Personal access tokens
- Cloud IAM keys
- Service-account credentials
- Database connection strings
- AI service keys
- CI/CD secrets
Five minutes or eight months after the theft.
A credential found minutes after the theft may still give access. One found months later is still intelligence.
- A valid password
- An active session
- Live VPN access
- Cloud and SaaS access
- Password reuseThe person may use the same password elsewhere.
- Password patternsA password ending in last year’s number often returns with this year’s.
- Endpoint evidenceA stealer hit proves the device was compromised, whatever happens to one password.
- Other stolen accountsThe same infection usually holds dozens of other credentials.
- Cookies and tokensA new password does not tell you whether every session is safe.
- Incident historyIt shows the identity or device was exposed before a later intrusion.
- Third-party riskA contractor’s old leak can point to an unmanaged, infected device.
- Identity overlapA work email next to private services shows where work and private life meet.
- Risk scoringRepeated exposure is a different risk than none at all.
Not valid or invalid, but four kinds of risk.
A yes-or-no on validity misses most of the picture. We sort each exposure by what it means for you. From the infected laptop above:
Just over 1%of the leaked credentials checked in customer environments were still valid, in our own experience. We still count that as a lot: one valid account can be enough for a compromise.
- Active credential riskA password or token that may still work.The saved VPN login for vpn.northwind.example, three weeks old.
- Session riskA cookie or token that signs in without password or MFA while it is valid.A session cookie for sso.northwind.example.
- Endpoint compromise evidenceThe device was infected, whatever happens to one password.LAPTOP-NW-0427 itself: infected, whatever happens to one password.
- Historical identity exposureOlder leaks that show reuse, password patterns and earlier exposure.A private shop account that reuses the VPN password.
Every stealer log, opened down to the machine.
Search by domain, email or site. Each hit says why it came up, and one click opens the infected machine behind it.
- Why it came upMatched on login, website or password, shown on every hit.
- The full recordSystem, infection path, malware family, credentials, cookies by site, tokens, autofill, files and a screenshot.
- DownloadThe full log as JSON in the dashboard or through the API. Exports give one row per machine.
https://vpn.northwind.example · j.doe@northwind.example · ••••••••- Machine
- LAPTOP-NW-0427
- User
- j.doe
- IP · country
- 203.0.113.58 · DE
- Malware
- Infostealer · High confidence
- Infection path
- C:\Users\j.doe\Downloads\invoice-viewer.exe
- 142Passwords
- 640Cookies
- 6Tokens
- 154Autofill
- 118Visited sites
- 97Files
Every exposed password, with novelty, risk and reuse.
Credentials are de-duplicated, scored and sorted into views, so your own systems, your people on other services and outsiders on your portals are never mixed up.
Same server, user name and password count once.
| User | Password | Server | Source | Novelty | Risk | Reuse | Leaks |
|---|---|---|---|---|---|---|---|
| j.doe@northwind.example | ••••••••meets policy | vpn.northwind.example | Stealer log | 10/10 | 9/10 | 2 | 1 |
| it-admin@northwind.example | ••••••••meets policy | sso.northwind.example | Open database | 9/10 | 8/10 | 0 | 1 |
| partner.ops@supplier.example | ••••••••weak | portal.northwind.example | Ransomware leak | 8/10 | 7/10 | 0 | 1 |
| applicant@mail.example | ••••••••weak | careers.northwind.example | Stealer log | 9/10 | 6/10 | 1 | 1 |
| j.doe@northwind.example | ••••••••meets policy | shop.example | Combo list | 7/10 | 5/10 | 2 | 3 |
| recruiting@northwind.example | ••••••••weak | jobs-board.example | Database breach | 6/10 | 4/10 | 0 | 1 |
| sales.emea@northwind.example | ••••••••weak | streaming.example | Combo list | 4/10 | 3/10 | 3 | 4 |
- Novelty and riskTwo scores from 0 to 10 for every credential.
- Reuse and leaksPassword reuse, and every leak it appeared in.
- Password policyLeaked passwords that still meet your policy.
- Act on itMonitor, export or report from the same search.
Compare your domains, month after month.
The leaked credential comparison report puts divisions, subsidiaries or peers side by side. Run it once, or let it arrive on the 1st of every month for the month before.
- One-off or monthlyA monthly schedule starts with a baseline report for the last month.
- What is insideStealer logs versus combo lists, a three-month trend, the outside systems your staff use, your systems used by outsiders, and a password analysis.
- Your choiceFull or masked passwords, any research period, and a CSV file for every view.
Typical processing time: about 15 minutes.
- 74From stealer logs
- 54From combo lists
| View | Group | Research | Retail |
|---|---|---|---|
| Unique | 128 | 37 | 84 |
| Org | 74 | 22 | 51 |
| On 3rd party | 31 | 9 | 26 |
| Private | 12 | 3 | 14 |
| From 3rd party | 46 | 11 | 19 |
| Policy match | 9 | 4 | 6 |
| Weak | 61 | 15 | 40 |
Group northwind.exampleResearch northwind-labs.exampleRetail northwind-retail.example
Same server, user name and password count once.
Constant monitoring, plus a full API.
Monitors report only what is new since the last run, by email or webhook. The API adds the same searches, the full stealer logs and a credential check for your sign-up and login forms.
- MonitorsNew leaks for your domains, without searching again.
- Credential checkTest an email, a password or both at sign-up, login or password change.
- Stealer logsFind infected machines and fetch each full capture.
- AnalyticsTotals, the riskiest users and passwords, password strength.
POST /api/service/stealer_logs_search/query: northwind.examplesearch started · poll until it is ready3 infected machines with Northwind loginsLAPTOP-NW-0427 · 142 passwords · 640 cookiesfetch the botid_url of the machinethe full capture as JSON, with screenshotsrevoke the sessions, then reset and investigate
X-API-Key per workspace · monitors by email or webhook · JSON exports
From stealer log to training, in one flow.
When an employee’s work login turns up in a stealer log or a breach, CyberFrog, our sister company, trains them on what actually leaked, and you see when they are done.
Free for every DarknetSearch client
- Your alert rules decideYou pick which DarknetSearch alert rules trigger training. Checked daily by default, or as often as every hour.
- Only your own peopleMatched by work email to your directory. New addresses only on your own domain, and only if you allow it.
- Lessons on what leakedIt opens on their own record and explains stealer logs and saved passwords. Passwords only as your privacy settings allow.
- Completion you can seeWho was notified, started and finished, in one ongoing campaign. No repeat lesson for the same kind of leak within 30 days by default.
- 1DarknetSearch alert
j.doe@northwind-example.comin a stealer log, from your alert rule - 2Employee matched
Jamie Doe, Financeby work email, in your directory - 3Personal lesson
portal.northwind-example.comj.doe@… | [redacted]their record, about 8 min + quiz - 4Visible to your admin
Jamie Doe · completedquiz passed, in your results
Everything about credentials and stealer logs, in short.
People and machines
- Analysts in forums, markets, Telegram, Discord and paste sites every day
- Collectors and scrapers running around the clock
- Live stealer traffic, close to the source
Every leak described
- A written description, tags and three dates per leak
- Unverified seller claims flagged as such
- Original records kept and searchable
Cleaned
- Credentials de-duplicated across all sources
- An estimate of how much of a combo list is invalid
- Ransomware leaks classified file by file
The machine
- Host name, user, IP address, country
- Infection path and install date
- Malware family with a confidence level
The identity
- Saved logins: unique users, passwords and sites
- Cookies by site, tokens, autofill
- Visited login pages
The evidence
- A screenshot at the moment of infection
- The file tree of what was taken
- Full log as JSON; exports with one row per machine
Scores
- Novelty and risk from 0 to 10
- Reuse: how often the password appears with other accounts
- Leaks: every leak the credential appeared in
Dates
- When a device was infected
- When a leak was published, discovered and added
- First and latest sighting of a credential
Views
- Own infrastructure, org emails, private activity
- On third party and from third party
- Policy match and weak passwords
Set-up
- The domains registered to your organisation
- Research period: 30 days, 6 months, a year or custom
- Full or masked passwords
Monthly
- On the 1st of every month, for the month before
- Starts with a baseline report right away
- Optional end date
Inside
- Totals, stealer logs versus combo lists, three-month trend
- Top outside systems and your systems used by outsiders
- Password analysis and a CSV file per view
- We keep no history of your searches
- Reports run only on the domains registered to your organisation
- Passwords can be masked in every report
- Customer data is hosted in Germany
- We find what has leaked and reached our collection: a clean result does not prove an account is safe
- The platform does not test leaked passwords against your systems; risk and policy match help you prioritise
- Freshness depends on the source: live stealer traffic is new, combo lists are often recycled
- Industry figures on this page come from public reports by other companies
- Very large free-mail domains cannot be monitored as a whole
See which identities are already out there.
Check your domain now, start a free trial, or book a demo and look at your own domain with us.
Same check as on our homepage: number of leaked records for your domain, no sign-up.