Top sites where a given user appears in leaks (scoped)
For a given username, returns the top sites (host) where leaks involving that user have been observed, restricted to the org's monitored scope.
Used by the cockpit Users drawer expand-row to show per-user impacted sites.
Authorization
ApiKeyAuth API key for authentication
In: header
Query Parameters
1 <= length <= 320"root_domain" | "email_domain" | "all"Limit result length
Type of leak (combo, stealer)
Uniq identifier for the concatenation of : username, password and domain
Upload date on stealed, ISO 8601, pattern YYYY-MM-DD
Upload date on the plateform the credential was found, ISO 8601, pattern YYYY-mm-dd
Log date of the device at compromized moment (if applicable, stealer only)
Start date to search from leaks, format: YYYY-mm-dd (default: today - 14days at 0:00am)
End date to search leaks from, format YYYY-mm-dd (default: today)
URL of the leaked data
FQDN of the leaked data
Local part of the username section (if applicable, email only)
Protocol identified (if applicable)
Email domain to filter on (if multiple email domains declared)
Root domain to filter on (if multiple root domains declared)
Machine ID (if applicable, stealer only)
Computer name (if applicable, stealer only)
Hardware ID (if applicable, stealer only)
Machine user (if applicable, stealer only)
IP address (if applicable, stealer only)
Country (if applicable, stealer only)
Software (if applicable, stealer only)
Stealer name (if applicable)
Opaque source label(s) to filter on, of the form Source-<6 hex> (as returned by the sources breakdown). The raw telegram_channel is never exposed: the label is matched back against the same MD5-prefix expression server-side.
Keyword to filter on (only active keywords for tenant)
Match type for leaks_matched table (root_domain or email_domain)
Root domains to exclude (NOT IN filter)
Email domains to exclude (NOT IN filter)
Domains to exclude (NOT IN filter)
Types to exclude
Software to exclude
Stealer names to exclude
Protocols to exclude
Countries to exclude
Show only hashes whose first appearance (min upload_stealed) falls on this exact date. Format: YYYY-MM-DD.
Show only hashes whose first appearance (min upload_stealed) is on or after this date. Format: YYYY-MM-DD.
Minimum number of sources (source_count >= N)
Response Body
application/json
application/json
curl -X GET "https://api.stealed.io/leaks/user-sites?username=string&identifier_column=root_domain"null{
"detail": [
{
"loc": [
"string"
],
"msg": "string",
"type": "string"
}
]
}Paginated list of users grouped, with leak and site counts GET
Returns a paginated list of distinct usernames found in leaks for the org's monitored scope. For each user: total leak count and number of distinct sites where leaks appear. Used by the cockpit Users drawer to provide a user-centric drill-down view.
Paginated list of hosts grouped, with leak and user counts GET
Returns a paginated list of distinct hosts found in leaks for the org's monitored scope. For each host: total leak count and number of distinct usernames seen on that host.