Stealer Logs
Credentials harvested from malware-infected machines, with the full context of the device they came from.
HostnameOperating systemIP addressURLUsernamePasswordCookiesActive sessionsInfection date
Learn moreThe data behind every Whiteintel finding
Billions of leaked records, collected continuously from the places attackers actually work. This is what we hold, where it comes from, and what each record gives you.
- Credentials tracked
- 15B+Credentials tracked
- Stealer logs indexed
- 80M+Stealer logs indexed
- Dark web events
- 150K+Dark web events
- Threat actors
- 25K+Threat actors
- Stolen cards
- 5M+Stolen cards
Every dataset we provide
Seven datasets, one search. Each one carries the fields your team needs to act, not just a count.
ULPs
URL-login-password sets aggregated from combolists and credential dumps, normalised and deduplicated.
URLLoginPasswordSource batchFirst seen
Learn moreHacker Forum Posts
Posts from the forums and channels where breaches are announced, exploits are shared and access is sold.
RansomwareData breachesExploitsAccess salesFull post textScreenshotThreat actorForum and board
Learn moreLookalike Domain Monitoring
Domains registered to impersonate your brand, caught as they appear and enriched for triage.
DomainWHOISDNS recordsMX recordsLive screenshotRegistration date
Learn moreSupplier Security
Third-party exposure graded per vendor, so supply chain risk is measured rather than assumed.
Security scoreCritical eventsBreach exposureInfostealer exposureTrend over time
Learn morePayment Fraud Intelligence
Stolen cards traded in carding shops and dark web channels, mapped back to the issuers they affect.
BINIssuerCard brandMarketplace sourceFirst seen
Learn moreSecret Exposure
API keys, tokens and credentials committed to public repositories, found before they are abused.
Secret typeRepositoryFile pathCommitFirst seen
Learn moreA count tells you that you are exposed. A record tells you what to do about it.
Where the data comes from
Eight collection streams, running continuously. Nothing here is a one-off scrape.
Infostealer logs
Full logs from malware-infected machines, collected across the active families as they are traded and dumped.
LummaStealCVidarRedline+ more families
Combolists
URL, login and password sets aggregated from credential dumps, then normalised and deduplicated.
URL:login:passDeduplicatedSource batch
Breach databases
Third-party breach dumps, parsed and mapped back to the domains and accounts they affect.
ConsumerCorporateFirst seen
Hacker forums
The boards where breaches are announced, exploits are shared and initial access is sold, captured with full post text.
Post textScreenshotThreat actor
Telegram channels
Private and public channels used to distribute logs, leaks and access, monitored continuously.
Log dropsLeak claimsAccess sales
Onion sites and markets
Dark web marketplaces, carding shops and ransomware leak sites, indexed as listings appear.
Carding shopsLeak sitesMarketplaces
Public code repositories
Secrets committed to public repositories: API keys, tokens and credentials, found before they are abused.
GitHubSecret typeCommit
Domain registrations
Newly registered domains and certificate transparency logs, screened for impersonation of your brand.
1,500+ TLDsCT logsWHOIS
Collected continuously · new records indexed daily · every finding carries its source
Four ways to reach it
The same records, whichever way your team works.
01
Platform search
Query every dataset from one search bar by domain, email, IP, hostname or password, with filters and pivots.
02
REST API
The same records your analysts see, available to your own tooling. Leak Discovery, Dark Web Discovery and Payment Fraud endpoints.
03
Exports and archives
CSV exports with look-back windows by plan, plus full stealer-log archive downloads on the higher tiers.
04
Watchlists and webhooks
Watch domains, emails, keywords, BINs, suppliers and repositories. New matches arrive by email, webhook or SOAR.
More than 100 enterprises worldwide trust our data to protect them
See what our customers are saying.
Verified reviews from CISOs, SOC managers, and security operations teams running Whiteintel in production.
Rich Data, Reliable API, and Prompt Personal Service
Whiteintel provides us a rich dataset through a reliable API that allows us to flag at-risk user accounts and protect our customers' data. The API performs as well, and service is always personal and prompt. The price point aligns well with the value it provides to our organization.
Get Started for Free
Dark web intelligence built on 15B+ exposed credentials and 25,000+ tracked threat actors. See what is already circulating about your organization, and shut it down first.
Dataset FAQs
Collection runs across infostealer command-and-control servers, hacker forums, Telegram channels, criminal marketplaces, carding shops, paste sites, public code repositories and third-party breach databases. Collection is continuous rather than scheduled, and every record retains its originating source so the reliability of a finding can be assessed independently.
Breach aggregators republish public dumps, which are historical, frequently hashed and shared by every vendor using the same corpus. Whiteintel's primary dataset is infostealer logs taken from infected devices, containing plaintext passwords, session cookies and device context, and rarely public at any point. Breach data is included as a long tail rather than as the core of the dataset.
Most new records are parsed, deduplicated and indexed within minutes of collection. Depth covers the full indexed corpus rather than a rolling window: more than 80 million stealer infection logs and more than 15 billion exposed credentials. Every record carries first-seen and last-seen dates, making recency a filterable field rather than an assumption.
All three. The platform interface supports investigation, a REST API provides programmatic access across Leak Discovery, Dark Web Discovery and Payment Fraud endpoints, and CSV export supports reporting. Higher plan tiers additionally provide full stealer-log archive downloads.
Yes. Raw collection is parsed into a consistent schema, duplicates are collapsed so that one exposure produces one record rather than one per re-listing, and identities are correlated across sources. Each record retains every date on which it resurfaced, so deduplication does not remove the exposure timeline.
Standard plans license the data for the subscribing organization's own security use. Resale and customer-facing product integration rights are available from the Threat Intelligence tier, which is the basis on which MSSPs and security vendors build services. Custom data-sharing terms can be scoped where a use case requires them.