Every dataset an attacker already has, in one search box.
Leaked.Domains indexes breach data, stealer logs, combolists, WHOIS, DNS, certificates and people data into a single searchable platform. Start from a domain, an email, a username or a hash, then pivot across every dataset at once to see what is exposed before someone else finds it.
One query, every dataset, side by side
Pick a data point, type a value, and every source that matches lights up at once: breach credentials, stealer logs, combolists, people data, social profiles, WHOIS and infrastructure.
- Search by domain, email, username, name, password, hash, IP, ASN, AS org, telephone, street address, card or BIN.
- Password hashes resolve across MD5, SHA-1, SHA-256, SHA-512, NTLM and LANMAN.
- Every result is a pivot: click a value to search it, and the discovery chain records the route you took.
- Export the lot as CSV, generate a PDF report, or push the chain onto the canvas.
Open the infected machine, not just the password
Stealer logs are the freshest credential source there is, because they come off live infected machines. Every credential is tied to a host you can open and work through.
- 766,777,247 saved logins and 2,088,342,881 session cookies, the artefact most likely to get past MFA.
- The host view shows the machine, its signals, every credential taken from it and the other logs from the same host.
- Browse the stolen file tree, and see which logs share a credential.
Ask precise questions in one line
A query language for analysts who know exactly what they want. Combine fields, exclude sources, restrict by year, then pivot the answer into counts or a top-ten.
- A year histogram you can click to filter, and saved queries you can watch for new results.
user:j.smith has:password seen:>2024 -src:whois
domain:example.com | count by src,year
site:vpn.example.com | top domain 10Map an organisation's infrastructure as a case
Add a domain, IP, ASN or certificate fingerprint and Investigate expands it across certificates, passive DNS and subdomains. Each entity gets a confidence score from how many independent sources agree.
- Results, graph and timeline views of the same case.
- Confirm, dispute or send findings to a review queue, with a full audit trail.
- Cases can be grouped into a project session alongside your searches.
Keep watching, and widen the picture
Register what you are responsible for and be told when it shows up, then enumerate the infrastructure around it without leaving the platform.
Asset Monitor Beta
Domains, emails and IPs are re-checked every three days against breach data, stealer logs, combolists, people data, DNS and WHOIS. You get an email when something new turns up. Monitoring has its own credits, separate from searches.
Passive tools
- Subdomains without sending a packet
- TLD Lookup for the same name under other TLDs
- AS Org Keyword to map netblocks
- PW Hash Lookup against the hash database
Active tools
- WhatsMyName across 600+ sites
- Subdomains with resolving IPs
- File Discovery across 20+ file types
- Favicon Lookup for related hosts
Built for investigations, not just lookups
A single hit is rarely the answer. Every result is a starting point for the next query, and the platform keeps track of how you got there.
Canvas
Map what you find on an interactive graph. Pivot from any node, lock the layout, then save it, export it as an image or JSON, or share it.
Project Sessions
Keep engagements apart. Every search, pivot, canvas and case is filed under the session you are working in.
Discovery Chains
Your pivot path is kept as an ordered chain, from first lead to final finding. Save it, reload it, or push it onto the canvas.
Search History
Every query is recorded with the datapoint it came from, so you can retrace your steps and show your working.
Share with your team
Hand a colleague a canvas or a whole session using a share key that expires after 24 hours.
Data exports
Pull result sets out as files for your own tooling, and download earlier exports again from your account.
Reports with your name on the cover
Generate a client-ready exposure report for any domain in one click. With the white-label add-on the report carries your company name, colour and logos instead of ours, on the cover design you choose.
Edit your branding yourself
- Five cover designs, every one coloured with your accent.
- Your company name, website, contact email, cover logo and small logo.
- A live preview of the first page as you change it, before anything is saved.
- You always edit your own copy, so nobody else's reports change.
Find it under User Profile → Report Branding.
Leaked.Domains in every tab
Search whatever you are looking at without copying and pasting. The extension recognises domains, URLs, emails, IPs, ASNs and hashes, cleans up defanged indicators, and opens the search in your own signed-in session.
ld example.comld !user jsmithld qc domain:x has:passwordSmart search popup
Detects what you typed or pasted and sends it to Universal Search, Query Console or Investigate.
Right-click anything
Search a selection or a link, extract indicators, or scan and highlight the whole page.
Workbench
Paste text or drop files to get de-duplicated indicators, then bulk-open, copy defanged or export them.
Toolkit
DNS and email security, certificate transparency, lookalike domains, email header analysis, hashing and decoding. No account needed.
Side panel
Keep the extension open next to the page you are working on.
Live counts
Connect the extension to your account to see how many records each dataset holds for the site you are on.
The same index, from your own pipeline
Search, per-domain counts, dataset metadata, password checks and full PDF report generation, documented in a live Swagger reference you can try from the browser.
- Included with the API and Enterprise plans, and available as an add-on for Researcher and Power User.
- API calls use API credits, kept separate from your search credits. Top-ups are available from your plan.
- Generate the same white-label report through the API, with any of its ten sections.
$ curl -u "$LD_USER:$LD_KEY" \
-d search_tag=domain -d search_term=example.com \
-d table=all \
https://api.leaked.domains/api/v2/meta_counts/
[{ "leakdb": 1284, "stealer_v2": 312,
"stealer_ulp": 2071, "peopledb": 96 }]What is in the index
Record counts are taken from the live index and update as new data lands.
Sensitive data, kept under control
Two-factor sign-in
TOTP two-factor authentication with an authenticator app, and brute-force protection on verification.
Domain verification
Verify the domains you are responsible for to unlock deeper access to the records that concern them.
Demo Mode
One click blurs personal data on screen, so you can present findings or share your screen safely.
Remove your data
Found your email address or your company's domain here? You can remove it yourself, for free. Once you confirm it is yours, matching records stop appearing in every search, report, export, alert and API result, for every account.
1. Create a free account
Sign up with the email address you want removed, or with any address if you are removing a domain.
2. Prove it is yours
For an email address, open the link we send to it. For a domain, add a DNS TXT record we give you. Nothing is removed on an unverified request.
3. It is removed
Records are removed from results straight away. You can also ask for them to be deleted permanently, and delete your account afterwards.
Removal covers the leaked datasets: breach data, people data, LinkedIn, Facebook and stealer credentials. Public records such as WHOIS, DNS, certificates and subdomains are not changed.
See what is already exposed
Search your own domain and find out what an attacker would find first. Plans scale from individual researchers through to enterprise and law enforcement.