Coverage
What we can actually look up
14 lookup types, served from several external data sources. Every result row names the module it came from, so you can trace a finding back to its origin instead of trusting a black box.
Lookup types
14 identifiers, grouped by what they point at
Open any identifier for the sources queried against it, the format it expects, and what a match does and does not mean.
Identity
Details that point at a person rather than a machine.
Accounts and devices
Accounts, and the hardware fingerprints attached to them.
Infrastructure and entities
Domains, network blocks, on-chain addresses and registered companies.
Secrets and files
Credential material, and the provenance of a known file.
Sources
Where records come from
These are the modules behind each result. We do not claim every module is queried on every search, because a given identifier is often only present in one or two of them.
Breach and credential data
- Snusbase
- IntelX
- LeakCheck
- HackCheck
- BreachBase
- IntelVault
- Stealer logs
- Discord dumps
Credential and session data drawn from breach corpora. Some modules carry sets that are years old while others are refreshed continuously, which is why a match can look stale next to a fresh one.
Registries and network data
- MACLookup
- IEEE OUI registry
- Blockscout
- crt.sh
- RDAP
- GLEIF
- Team Cymru
- Spamhaus DROP
- Tor Project
Public registries and network allocations. These are queried live against the authority that holds the record, so a finding carries that authority behind it rather than our own copy.
Identity and reference
- Maigret
- Sherlock
- GitHub
- Wikidata
- Gravatar
- CIRCL hashlookup
Account enumeration and reference data used to establish whether an identifier exists at all, and where it is registered.
Distinct modules queried across the platform: 25. Counting is done on distinct module names, so a module reached by more than one path is only counted once.
Limits
Honest limits
What a result can and cannot tell you, stated before you spend a credit rather than after.
- 01
Coverage is a property of the underlying sources, not of our interface. A clean result means the identifier was not found in the modules that were queried, which is not the same as the identifier being absent from every breach that exists.
- 02
Freshness varies by module. Some sources carry data that is years old and others are updated continuously, and rows carry the date the source recorded where one is available.
- 03
We do not publish a total record count. Competitor pages quote very large numbers and we cannot verify how those are measured, so we would rather publish nothing than a figure we cannot stand behind.