Retrieve public exposure analytics stats for a domain

Endpoint to retrieve pre-aggregated analytics statistics for a domain. Restricted to MSSP role. No raw credential data is returned -- stats only. Data comes from the harmonised global stats tables (the same hash-deduplicated source the cockpit / Référencé views consume), so figures are coherent across the product. Coverage starts from when the stats pipeline began accumulating.

Returns:

total_leaks: Total number of leaks (hash-deduplicated)
unique_usernames: Unique usernames (HyperLogLog estimate)
unique_passwords: Deprecated -- always 0 (not aggregated in the stats pipeline)
unique_leaks: Unique credentials by hash (equals total_leaks)
unique_sources: Deprecated -- always 0 (not aggregated in the stats pipeline)
unique_domains: Unique cross-domains seen in the leaks
latest_leak_date: Date of the most recent leak
leaks_by_type: Leaks split by type (Stealer / Combo)
leaks_by_day: Leak timeline (daily for 30d, monthly for 12m)
leaks_by_stealer: Top 20 stealer families
leaks_by_country: Top 20 countries
subdomains: Top 50 compromised sub-domains

Example Usage:

GET /leaks/stats/analytics?domain=example.com&identifier_column=root_domain
GET /leaks/stats/analytics?domain=gmail.com&identifier_column=email_domain

Authorization

ApiKeyAuth

X-API-Key<token>

API key for authentication

In: header

Query Parameters

domain*Domain

Domain to look up (single value)

identifier_column*Identifier Column

Column to match domain against

Value in"root_domain" | "email_domain"

time_range?Time Range

Time window: '30d' for last 30 days (daily), '12m' for last 12 months (monthly)

Default"12m"

Value in"30d" | "12m"

Response Body

`application/json`

curl -X GET "https://api.stealed.io/leaks/stats/analytics?domain=example.com&identifier_column=root_domain&time_range=12m"

{
  "latest_leak_date": "2025-03-01",
  "leaks_by_country": [
    {
      "count": 3100,
      "name": "FR"
    },
    {
      "count": 2800,
      "name": "US"
    }
  ],
  "leaks_by_day": [
    {
      "count": 450,
      "date": "2025-02-28"
    },
    {
      "count": 310,
      "date": "2025-03-01"
    }
  ],
  "leaks_by_stealer": [
    {
      "count": 4200,
      "name": "RedLine"
    },
    {
      "count": 2100,
      "name": "Raccoon"
    }
  ],
  "leaks_by_type": [
    {
      "count": 9800,
      "type": "Stealer"
    },
    {
      "count": 2700,
      "type": "Combo"
    }
  ],
  "subdomains": [
    {
      "count": 1234,
      "domain": "mail.example.com"
    },
    {
      "count": 567,
      "domain": "www.example.com"
    }
  ],
  "total_leaks": 12500,
  "unique_domains": 320,
  "unique_leaks": 10200,
  "unique_passwords": 0,
  "unique_sources": 0,
  "unique_usernames": 8300
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string"
    }
  ]
}

Retrieve public exposure analytics stats for a domain

Authorization

Query Parameters

Response Body

200application/json

422application/json

`application/json`

`application/json`