Domain exposure
Find mailboxes, SSO accounts, and employee logins tied to a company domain.
Infostealer intelligence Fresh logs
Know what attackers already know.
Search the stealer logs attackers trade. Get the URL, login, password, source, and date in one result. Use your welcome code for 3 free credits, then export or integrate the API.
- 3 welcome credits
- 25-row preview
- Bulk and API on paid plans
Fictional sample
example.com
URLEmailPassword
Fictional accounts for illustration only
Try the live demo
Billionsstealer log records
Up to 10,000records per query
Full resultsURL, email, password, source
Bulk + APIon paid plans
3 free creditswith a welcome code
Sample report
From a domain to an exposed credential.
This is a fictional sample of the fields returned for each record: URL, email, password, publication date, source, and the archive file name.
Fictional sample5 records · example.com
| URL | Password | Posted | Source | File | |
|---|---|---|---|---|---|
| https://mail.example.com/login | [email protected] | Summer2026! | Oct 18, 2026 | Demo archive | SampleCloud201823.zip |
| https://vpn.example.com/login | [email protected] | Tr0ub4dor! | Oct 16, 2026 | Demo archive | VPN-Access-2026-10-16.zip |
| https://remote.example.com/login | [email protected] | Deploy2026? | Oct 12, 2026 | Demo archive | RemoteDump-2026-10-12.zip |
| https://webmail.example.com/login | [email protected] | Ledger#2026 | Oct 10, 2026 | Demo archive | WebmailDump-2026-10-10.zip |
| https://login.example.com/ | [email protected] | Adm1n!2026 | Oct 8, 2026 | Demo archive | LoginCapture-2026-10-08.zip |
Fictional accounts, URLs, and files. No file download is provided.Try the live demo
Use cases
Built for exposure work.
Search the same data from the angle that matters to you.
Vendor checks
Check a vendor, agency, or subsidiary domain before onboarding or during due diligence.
Credential reuse
Search an email, username, or password and see where it appears in exposure data.
Bug bounty recon
Spot exposed accounts and login portals on a target before testing.
Workflow
From a domain to evidence in three steps.
Built for authorized security work, exposure monitoring, and bug bounty recon.
Search
Query a domain, email, username, password, URL, or IP. Each new query returns the first 25 records.
Validate
Review the exposed account, the service, the publication date, and the record type before you act.
Export or integrate
Export a page, download the full result, or consume the API from your own tooling on a paid plan.
Pricing
Daily quotas. No auto-renewal.
Plans from $19/month — about $0.63/day. Monthly plans last 30 days; quarterly prepay is 90 days with 10% off. Daily quotas reset at 00:00 UTC. BTC only at launch.
Loading plans…
Pro is the sweet spot: 500 searches/day — 5× the daily searches of Starter for about 2.5× the price.
Quarterly prepay: 3 months with 10% off. Have a welcome code? Redeem it in Account to add 3 credits. Credits return the 25 rows on the first page of a search; paid plans unlock pagination, bulk download, API access, and priority processing.
Developer first
An API you can ship with.
Every paid plan includes a bearer key. Search, bulk export, and quota checks from your backend, scripts, or Postman.
- Keys prefixed with lk_live_
- JSON responses with full results
- Daily quotas and GET /api/me
- OpenAPI specification
curl -X POST https://infostealerlogs.com/api/search \
-H 'Authorization: Bearer lk_live_...' \
-H 'Content-Type: application/json' \
--data '{"query":"example.com","type":"email_domain"}'{
"hits": [
{
"account": "[email protected]",
"password": "example",
"originHost": "portal.example.com",
"recordType": "credential"
}
]
}
Security and trust
Minimal data. Clear boundaries.
Passwords hashed
Account passwords use scrypt with a per-user salt. Plaintext passwords are never stored.
Hashed sessions
Session cookies are random, HTTP-only, and stored server-side as SHA-256 hashes.
Upstream key stays server-side
Customers receive their own lk_live_ key. The data-provider key is never exposed.
No trackers
The app ships without third-party analytics, advertising pixels, or external scripts.
FAQ
Before you start.
What does the welcome code give me?
3 credits. Each credit returns the 25 rows on the first page of a new search. Pagination, bulk download, API access, and priority processing require a paid plan.
What is a stealer log?
A record from infostealer malware that captured saved logins on an infected device. The record can include the URL, login, password, publication date, and source label.
What can I search?
Domain, email, URL, username, password, or IP. One identifier per search. The landing search box opens the console with your query ready to run.
What does a hit include?
URL or service host, email, password, publication date, source, and record type. File names in the sample are illustrative; this deployment does not expose file endpoints.
Why do I only see up to 10,000 records?
The upstream search index returns at most 10,000 records per query. The console pages through them 25 at a time; bulk download returns the available set.
Where does the data come from?
This deployment is a search layer over a licensed data provider. It does not run malware or collect logs itself. Coverage and freshness depend on the provider.
My login is in a log. What now?
Clean the infected device first. Then change passwords from a device that was not infected, end other sessions, and enable two-factor authentication.
Can I use the API on the free credits?
No. API keys are issued only with an active paid plan. The key is shown in Account and can be regenerated at any time.
How long does a plan last?
30 days for a monthly plan; 90 days if you prepay quarterly (10% off). Daily quotas reset at 00:00 UTC. Crypto payments do not auto-renew; you create a new payment when you want another period.
How do I pay?
BTC at launch. Choose a plan, continue to the BTCPay checkout, and pay the address or QR shown there. Use the same email as your account. Your plan is activated manually after the payment is confirmed.
What data do you store?
Email, hashed password, hashed session, plan, API key, daily usage, credits, and payment references. Search results are cached in memory for up to 10 minutes and are not written to the database by the server.
Is this for authorized use only?
Yes. Use it for authorized security assessments, exposure monitoring, and incident response. Do not use it to access accounts without permission.