What a stealer-log record holds
Origin URL
The website or app the credentials were entered on — the detail a database breach never has.
Login
The email address or username used to sign in.
Password
The password as the browser saved it — usually in plain text.
How to search the logs
By email or username
Stealer-log records show up in your regular search results next to breach data, with the date the log was collected.
By website
Search by origin to see every credential captured for a site — your company's sign-in page, for example. Enterprise plan.
Through the API
The same origin search is available as type=origin in the Pro API.
Info-stealer log questions
Files produced by info-stealer malware on an infected computer or phone. They hold the logins saved on that device — usually the site address, the username or email and the password — and are sold or published on criminal forums and Telegram channels.
A data breach leaks one company's database. A stealer log comes from your own device and can hold credentials for every site you saved in the browser.
Search your email address or username as usual: stealer-log records appear in the results with the date the log was collected.
Search by origin — the website the credentials belong to — is part of the Enterprise plan.
Assume the device was infected: scan and clean it, or reinstall the system, before anything else. Then change the passwords that were saved in that browser, sign out of other sessions and turn on two-factor authentication.
