leaked_credential event type represents a single leaked credentials, usually in the form of a url:login:password triplet.
Example Content
{
"activity": {
"data": {
"es_id": "425470/leaked_credential/combolists/9492d3cb916d17660421053e3a68674f",
"es_score": 1,
"highlights": {},
"id": null,
"index": "leaked_credential",
"metadata": {
"estimated_created_at": "2026-03-05T05:48:05.031000+00:00",
"event_id": null,
"first_crawled_at": "2026-03-05T05:49:52.429348+00:00",
"last_crawled_at": "2026-03-05T05:49:52.429348+00:00",
"payload_digest": "5f59f9014eb1121f56701d818f482091c04e1b93",
"scraped_at": "2026-03-05T05:49:52.429348+00:00",
"source": "combolists",
"crawled_by": null,
"flare_url": "https://app.flare.io/#/leaked_credential/combolists/9492d3cb916d17660421053e3a68674f"
},
"uid": "leaked_credential/combolists/9492d3cb916d17660421053e3a68674f",
"url": null,
"browser_url": null,
"domain": null,
"identity_name": "example_user@example.com",
"imported_at": "2026-03-05T05:48:05.031000+00:00",
"password": "ExamplePassword", # Only shown with the appropriate permission
"source_id": "combolists",
"source_name": "Combolists",
"leak_id": 406285232303,
"leak_source": {
"id": "combolists",
"name": "Combolists",
"description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
"description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) échangées sur des réseaux illicites.",
"breached_at": null,
"leaked_at": null,
"pii_tags": []
},
"features": {
"domains": [
"example.com"
],
"emails": [
"example_user@example.com"
],
"ip_addresses": null,
"ip_addresses_cidr": null,
"reversed_domains": [
"com.example"
],
"urls": null,
"usernames": null,
"vulnerabilities": null
}
},
"duplicates": [],
"header": {
"actor": null,
"actor_id": null,
"bank": null,
"bin": null,
"brand": null,
"credential_count": null,
"category_name": "Leaked Credential",
"content_hash": "5f59f9014eb1121f56701d818f482091c04e1b93",
"content_preview": "Email / Username: example_user@example.com",
"country": null,
"duplicates": [],
"es_score": 1,
"expiration": null,
"highlights": {},
"host": null,
"id": "9492d3cb916d17660421053e3a68674f",
"infection_date": null,
"parent_id": null,
"parent_title": null,
"parent_title_en": null,
"parent_uid": null,
"parent_uids": [],
"risk": {
"score": 4
},
"similar_items_count": 0,
"source": "combolists",
"source_name": "Combolists",
"target_name": "Combolists",
"tags": [],
"notes": null,
"state_code": null,
"timestamp": "2026-03-05T05:48:05.031000+00:00",
"title": "",
"type": "leaked_credential",
"uid": "leaked_credential/combolists/9492d3cb916d17660421053e3a68674f",
"user_risk_score": null,
"user_notes": null,
"ignored_at": null,
"remediated_at": null,
"verb": "",
"external_url": null,
"external_netloc": null,
"can_have_duplicates": true,
"priority_action_uuid_related": false,
"analyzers_items_uids": [],
"victim_name": null,
"contains_secrets": null,
"secrets_metadata": null,
"identity_name": "example_user@example.com",
"password": "ExamplePassword" # Only shown with the appropriate permission
},
"history_logs": null,
"metadata": {
"estimated_created_at": "2026-03-05T05:48:05.031000+00:00",
"event_id": null,
"first_crawled_at": "2026-03-05T05:49:52.429348+00:00",
"last_crawled_at": "2026-03-05T05:49:52.429348+00:00",
"payload_digest": "5f59f9014eb1121f56701d818f482091c04e1b93",
"scraped_at": "2026-03-05T05:49:52.429348+00:00",
"source": "combolists",
"crawled_by": null,
"flare_url": "https://app.flare.io/#/leaked_credential/combolists/9492d3cb916d17660421053e3a68674f"
},
"similar_items": []
}
}