What does an email-domain search find?

Saved logins that use an address at that domain, taken from infected devices. A hit usually means a staff or customer machine was infected while that address was saved in the browser.

What does a URL search find?

Logins saved for that host, such as the SSO, VPN, or admin panel, even when the username is not an email at your domain.

Why does a large domain stop at 10,000 records?

Elasticsearch will not page past 10,000 hits. Search a specific email or a login URL to see a tighter set.

Search a company domain

When a staff laptop or a home PC is infected, the browser's saved work logins go with it. Search the company domain to see those addresses in the index.

Two search types

Email domain matches logins like [email protected]. URL matches the sites people saved, such as the SSO or VPN host. Run both. A customer who signed in with Gmail will not appear in the email-domain search and will appear in the URL search.

Why companies appear

Staff sign in to work tools from home computers. They install pirated software on work laptops. They click fake updates. Buyers search purchased logs for corporate domains.

Cookies skip the password

A log can include live session cookies for company apps. Loading those cookies signs the buyer in as that employee, without the password and often without a two-factor prompt. Open the log and filter cookies by your login domain.

What to do with a hit

Find the people, reset their passwords from a clean device, revoke sessions and tokens, and inspect the machine they used. Open the log to see the other accounts and cookies on that box. The order of work is on Found in a log.

The 10,000-record window

A large domain can match more than 10,000 records. Elasticsearch will not return hits past that window. Search a specific email, a login URL, or turn on Hide results with no files. Why the window exists.

Questions

What does an email-domain search find?: Saved logins that use an address at that domain, taken from infected devices. A hit usually means a staff or customer machine was infected while that address was saved in the browser.
What does a URL search find?: Logins saved for that host, such as the SSO, VPN, or admin panel, even when the username is not an email at your domain.
Why does a large domain stop at 10,000 records?: Elasticsearch will not page past 10,000 hits. Search a specific email or a login URL to see a tighter set.

About
What the index searches and who it is for.
What is a stealer log
The dump one infected machine produces.
Found in a log
Clean the device first, then change passwords.
Sources and the 10,000 limit
Telegram bots, and why Elasticsearch stops at 10,000.
Infostealer families
RedLine, Lumma, Vidar, Raccoon, StealC, Atomic.