Filters narrow the records selected by your Search Scope. Add them as query parameters.
Source type
| Filter | Values | Meaning |
|---|
data_type | infostealer, data_breach | Source category. Repeat the parameter for OR. |
sub_type | database_dump, data_breach_combo_list, stealer_logs, stealers_combo_list | Finer source type. Repeat for OR. |
Credential content
| Filter | Example | Meaning |
|---|
has_password | has_password=true | Only records that have (true) or lack (false) a password. |
password_type | password_type=plaintext | Filter by password type. Repeat for OR. |
is_premium | is_premium=true | Data from premium (paid) sources. |
Service classification
Records carry the kind of service the login belongs to, derived from the login URL.
| Filter | Example | Meaning |
|---|
service_category | service_category=VPN | Broad service class. |
service_name | service_name=Fortinet | Specific application. |
Breach & URL
| Filter | Example | Meaning |
|---|
breach_uuid | breach_uuid=0a1b...4567 | Records from one breach (40-char hex). Still needs a domain or email scope. See Breach Catalog. |
breach_name | breach_name=example leak | Free-text match on the breach name (all words must match). |
login_url | login_url=portal.example.com | Free-text match on the login URL. |
Sorting
| Parameter | Values | Default |
|---|
sort_by | crawled, breached | crawled |
order_by | asc, desc | asc |
Results are tie-broken by record uuid. Keep sort_by and order_by fixed while paging - see Pagination.
