Skip to main content
The leak event type represents a list of leaked credentials over a time period, usually in the form of a url:login:password triplet. These leaks can sometimes contain duplicated credentials that were found in a separate stealer log.
Example Content
{
  "activity": {
    "data": {
      "es_id": null,
      "es_score": null,
      "highlights": null,
      "id": "user_12345",
      "index": "leak",
      "metadata": {
        "estimated_created_at": "2025-03-10T12:34:56Z",
        "event_id": null,
        "first_crawled_at": "2025-03-10T12:34:56Z",
        "last_crawled_at": "2025-03-10T12:34:56Z",
        "payload_digest": null,
        "scraped_at": null,
        "source": "dark_web_forum",
        "crawled_by": null,
        "flare_url": null
      },
      "uid": "leak/groups/username/user_12345/dark_web_forum/000001",
      "url": null,
      "browser_url": null,
      "identities": {
        "name": null,
        "passwords": {
          "domain": null,
          "hash": null,
          "hash_type": null,
          "extra": null,
          "id": null,
          "imported_at": null,
          "source_id": null,
          "source_params": null
        }
      },
      "leak_source": {
        "id": "dark_web_forum",
        "name": "Dark Web Forum",
        "description_en": "Credentials exposed on underground marketplaces or stealer logs.",
        "description_fr": "Identifiants exposés sur des forums clandestins ou journaux de vol de données.",
        "breached_at": null,
        "leaked_at": null,
        "pii_tags": []
      }
    },
    "duplicates": null,
    "header": {
      "actor": null,
      "actor_id": null,
      "bank": null,
      "bin": null,
      "brand": null,
      "credential_count": null,
      "category_name": null,
      "content_hash": "abcdef1234567890abcdef1234567890abcdef12",
      "content_preview": null,
      "country": null,
      "duplicates": null,
      "es_score": null,
      "expiration": null,
      "highlights": null,
      "host": null,
      "id": "user_12345",
      "infection_date": null,
      "parent_id": null,
      "parent_title": null,
      "parent_title_en": null,
      "parent_uid": null,
      "parent_uids": null,
      "risk": {
        "score": 4
      },
      "similar_items_count": null,
      "source": "groups",
      "source_name": "Dark Web Forum",
      "target_name": null,
      "tags": null,
      "notes": null,
      "state_code": null,
      "timestamp": null,
      "title": "user_12345 leak on Dark Web Forum",
      "type": "leak",
      "uid": "leak/groups/username/user_12345/dark_web_forum/000001",
      "user_risk_score": null,
      "user_notes": null,
      "ignored_at": null,
      "remediated_at": null,
      "verb": null,
      "external_url": null,
      "external_netloc": null,
      "can_have_duplicates": null,
      "priority_action_uuid_related": null,
      "analyzers_items_uids": null,
      "victim_name": null,
      "contains_secrets": null,
      "secrets_metadata": null
    },
    "history_logs": null,
    "metadata": {
      "estimated_created_at": "2025-03-10T12:34:56Z",
      "event_id": null,
      "first_crawled_at": "2025-03-10T12:34:56Z",
      "last_crawled_at": "2025-03-10T12:34:56Z",
      "payload_digest": null,
      "scraped_at": null,
      "source": "dark_web_forum",
      "crawled_by": null,
      "flare_url": null
    },
    "similar_items": null
  }
}