Most powerful & affordable stealer log search engine
Search email, username, URL, password, or IP across 44 billion stealer logs. Full results and API access from $20/month.
44 billionstealer logs
37 millionmachines
Use cases
Employee exposure
Search a company or vendor domain. A hit opens the SSO and remote access logins on that machine.
Customer takeover
Search your login URL. The hits are customer passwords and session cookies from infected devices.
Live sessions
Filter cookies by your login domain. Those tokens are live sessions.
Infected host
One hit is one machine. The log also has the other logins, cookies, and IP. Corporate accounts show up on personal devices.
Simple API
- /api/searchSearch the index
- /api/logs/{id}/credentialsOther accounts on the box
- /api/logs/{id}/cookiesSession tokens
- /api/logs/{id}/filesWallets, messengers, system
- /api/logs/{id}/contentOne file
Pricing
Pay with crypto: Bitcoin, Ethereum, Litecoin, Solana, USDT (Solana), or XMR. Compare with OathNet and Intelligence X.
Plus
$20/mo
Light use.
200 searches / day
- Web + API
- All search types
- Resets daily
- Basic support
Pro
Most used
$30/mo
Daily use.
1,000 searches / day
- Web + API
- All search types
- Resets daily
- Basic support
Max
$200/mo
Heavy use.
Unlimited searches / month
- Web + API
- All search types
- No daily cap
- Priority support
API
Search is available over an API. Read the documentation.
Learn
- About
What the index searches and who it is for.
- What is a stealer log
The dump one infected machine produces.
- Found in a log
Clean the device first, then change passwords.
- Company domain
Find staff and customer addresses in the index.
- Sources and the 10,000 limit
Telegram bots, and why Elasticsearch stops at 10,000.
- Infostealer families
RedLine, Lumma, Vidar, Raccoon, StealC, Atomic.
FAQ
- What is a stealer log?
- A dump from infostealer malware: saved logins, cookies, autofill, wallets, messengers, and the box it ran on.
- What can I search?
- Email, email domain, username, URL, password, or IP. One identifier per search. Matches come from indexed stealer logs and combo lines.
- What does a hit include?
- Origin, login, password, source, and post date. Stealer-log hits open the rest of that box.
- What's inside an opened log?
- Other accounts, cookies, autofill, wallets, Discord and Telegram tokens, and system info from the same machine.
- Do I need an account?
- Search is free. Hits show the full URL and part of the login and password. A plan is needed for the rest, for file contents, and for the API.
- Is there an API?
- Send a bearer token from an account with an active plan. The API allows 7 requests per second. Free site search does not apply. Endpoints return credentials, cookies, and files for a log.
- Where do the logs come from?
- Telegram bots and channels post the dumps. We collect those files and index each login. We do not run the malware.
- Why do I only see 10,000 results?
- Elasticsearch refuses a from and size query past 10,000 hits. A search can match more. The table pages through the first 10,000.
- My login is in a log. What now?
- Clean the infected device first. Then change passwords from a machine that was not infected, end other sessions, and turn on two-factor authentication.