StealedStealed Documentation
Open Stealed
API ReferenceLeaks

Retrieve leak statistics for a given domain and query

GET
/leaks/

Endpoint to retrieve leak statistics for the provided domain and query. Gated on the public_exposure tenant feature flag. Only analytics queries are allowed via this endpoint.

Authorization

ApiKeyAuth
X-API-Key<token>

API key for authentication

In: header

Query Parameters

identifier_column*Identifier Column

Column to use for identifying the domain

Value in"root_domain" | "email_domain" | "username"
domain*Domain

Domain to filter data on

query*Query

Query name to execute

username?|array<string>|

Username of the leaked user (can be phone, email, ID, ...)

type?|array<string>|

Type of leak (combo, stealer)

hash?|array<string>|

Uniq identifier for the concatenation of : username, password and domain

upload_stealed?||array<|string>|

Upload date on stealed, ISO 8601, pattern YYYY-MM-DD

upload_date?||array<|string>|

Upload date on the plateform the credential was found, ISO 8601, pattern YYYY-mm-dd

log_date?||array<|string>|

Log date of the device at compromized moment (if applicable, stealer only)

start_date?||

Start date to search from leaks, format: YYYY-mm-dd (default: today - 14days at 0:00am)

end_date?||

End date to search leaks from, format YYYY-mm-dd (default: today)

host?|array<string>|

URL of the leaked data

local_part?|array<string>|

Local part of the username section (if applicable, email only)

protocol?|array<string>|

Protocol identified (if applicable)

email_domain?|array<string>|

Email domain to filter on (if multiple email domains declared)

root_domain?|array<string>|

Root domain to filter on (if multiple root domains declared)

machine_id?|array<string>|

Machine ID (if applicable, stealer only)

computer_name?|array<string>|

Computer name (if applicable, stealer only)

hardware_id?|array<string>|

Hardware ID (if applicable, stealer only)

machine_user?|array<string>|

Machine user (if applicable, stealer only)

ip_address?|array<string>|

IP address (if applicable, stealer only)

country?|array<string>|

Country (if applicable, stealer only)

software?|array<string>|

Software (if applicable, stealer only)

stealer_name?|array<string>|

Stealer name (if applicable)

source?|array<string>|

Opaque source label(s) to filter on, of the form Source-<6 hex> (as returned by the sources breakdown). The raw telegram_channel is never exposed: the label is matched back against the same MD5-prefix expression server-side.

keyword?|array<string>|

Keyword to filter on (only active keywords for tenant)

match_type?|array<string>|

Match type for leaks_matched table (root_domain or email_domain)

not_root_domain?|array<string>|

Root domains to exclude (NOT IN filter)

not_email_domain?|array<string>|

Email domains to exclude (NOT IN filter)

not_domain?|array<string>|

Domains to exclude (NOT IN filter)

not_type?|array<string>|

Types to exclude

not_software?|array<string>|

Software to exclude

not_stealer_name?|array<string>|

Stealer names to exclude

not_protocol?|array<string>|

Protocols to exclude

not_country?|array<string>|

Countries to exclude

first_seen_date?|

Show only hashes whose first appearance (min upload_stealed) falls on this exact date. Format: YYYY-MM-DD.

first_seen_since?|

Show only hashes whose first appearance (min upload_stealed) is on or after this date. Format: YYYY-MM-DD.

limit?|

Limit result length

min_occurrences?|

Minimum number of sources (source_count >= N)

Response Body

application/json

application/json

curl -X GET "https://api.stealed.io/leaks/?identifier_column=root_domain&domain=string&query=string"
null
{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string"
    }
  ]
}

Retrieve public exposure analytics stats for a domain GET

Endpoint to retrieve pre-aggregated analytics statistics for a domain. Restricted to MSSP role. No raw credential data is returned -- stats only. Data comes from the harmonised global stats tables (the same hash-deduplicated source the cockpit / Référencé views consume), so figures are coherent across the product. Coverage starts from when the stats pipeline began accumulating. **Returns:** - `total_leaks`: Total number of leaks (hash-deduplicated) - `unique_usernames`: Unique usernames (HyperLogLog estimate) - `unique_passwords`: **Deprecated** -- always 0 (not aggregated in the stats pipeline) - `unique_leaks`: Unique credentials by hash (equals `total_leaks`) - `unique_sources`: **Deprecated** -- always 0 (not aggregated in the stats pipeline) - `unique_domains`: Unique cross-domains seen in the leaks - `latest_leak_date`: Date of the most recent leak - `leaks_by_type`: Leaks split by type (Stealer / Combo) - `leaks_by_day`: Leak timeline (daily for 30d, monthly for 12m) - `leaks_by_stealer`: Top 20 stealer families - `leaks_by_country`: Top 20 countries - `subdomains`: Top 50 compromised sub-domains **Example Usage:** ```bash GET /leaks/stats/analytics?domain=example.com&identifier_column=root_domain GET /leaks/stats/analytics?domain=gmail.com&identifier_column=email_domain ```

Preview keyword search results (stats only) GET

Preview the number of leaked credentials matching a keyword, along with the top root domains where the keyword appears. Returns aggregated stats only, no credential data. Available to all plans including Free. The keyword is matched as a **token** in the host/URL column using the ClickHouse text index. For example, keyword `acme-corp` matches `acme-corp-recrute.talent-soft.com` and `tekkit.io/offre/acme-corp/cdd`. **Example:** ``` GET /leaks/keyword/preview?keyword=acme-corp ```