Skip to main content
The leaked_credential event type represents a single leaked credentials, usually in the form of a url:login:password triplet.
Example Content
{
  "activity": {
    "data": {
      "es_id": "425470/leaked_credential/combolists/9492d3cb916d17660421053e3a68674f",
      "es_score": 1,
      "highlights": {},
      "id": null,
      "index": "leaked_credential",
      "metadata": {
        "estimated_created_at": "2026-03-05T05:48:05.031000+00:00",
        "event_id": null,
        "first_crawled_at": "2026-03-05T05:49:52.429348+00:00",
        "last_crawled_at": "2026-03-05T05:49:52.429348+00:00",
        "payload_digest": "5f59f9014eb1121f56701d818f482091c04e1b93",
        "scraped_at": "2026-03-05T05:49:52.429348+00:00",
        "source": "combolists",
        "crawled_by": null,
        "flare_url": "https://app.flare.io/#/leaked_credential/combolists/9492d3cb916d17660421053e3a68674f"
      },
      "uid": "leaked_credential/combolists/9492d3cb916d17660421053e3a68674f",
      "url": null,
      "browser_url": null,
      "domain": null,
      "identity_name": "example_user@example.com",
      "imported_at": "2026-03-05T05:48:05.031000+00:00",
      "password": "ExamplePassword", # Only shown with the appropriate permission
      "source_id": "combolists",
      "source_name": "Combolists",
      "leak_id": 406285232303,
      "leak_source": {
        "id": "combolists",
        "name": "Combolists",
        "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
        "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) échangées sur des réseaux illicites.",
        "breached_at": null,
        "leaked_at": null,
        "pii_tags": []
      },
      "features": {
        "domains": [
          "example.com"
        ],
        "emails": [
          "example_user@example.com"
        ],
        "ip_addresses": null,
        "ip_addresses_cidr": null,
        "reversed_domains": [
          "com.example"
        ],
        "urls": null,
        "usernames": null,
        "vulnerabilities": null
      }
    },
    "duplicates": [],
    "header": {
      "actor": null,
      "actor_id": null,
      "bank": null,
      "bin": null,
      "brand": null,
      "credential_count": null,
      "category_name": "Leaked Credential",
      "content_hash": "5f59f9014eb1121f56701d818f482091c04e1b93",
      "content_preview": "Email / Username: example_user@example.com",
      "country": null,
      "duplicates": [],
      "es_score": 1,
      "expiration": null,
      "highlights": {},
      "host": null,
      "id": "9492d3cb916d17660421053e3a68674f",
      "infection_date": null,
      "parent_id": null,
      "parent_title": null,
      "parent_title_en": null,
      "parent_uid": null,
      "parent_uids": [],
      "risk": {
        "score": 4
      },
      "similar_items_count": 0,
      "source": "combolists",
      "source_name": "Combolists",
      "target_name": "Combolists",
      "tags": [],
      "notes": null,
      "state_code": null,
      "timestamp": "2026-03-05T05:48:05.031000+00:00",
      "title": "",
      "type": "leaked_credential",
      "uid": "leaked_credential/combolists/9492d3cb916d17660421053e3a68674f",
      "user_risk_score": null,
      "user_notes": null,
      "ignored_at": null,
      "remediated_at": null,
      "verb": "",
      "external_url": null,
      "external_netloc": null,
      "can_have_duplicates": true,
      "priority_action_uuid_related": false,
      "analyzers_items_uids": [],
      "victim_name": null,
      "contains_secrets": null,
      "secrets_metadata": null,
      "identity_name": "example_user@example.com",
      "password": "ExamplePassword" # Only shown with the appropriate permission
    },
    "history_logs": null,
    "metadata": {
      "estimated_created_at": "2026-03-05T05:48:05.031000+00:00",
      "event_id": null,
      "first_crawled_at": "2026-03-05T05:49:52.429348+00:00",
      "last_crawled_at": "2026-03-05T05:49:52.429348+00:00",
      "payload_digest": "5f59f9014eb1121f56701d818f482091c04e1b93",
      "scraped_at": "2026-03-05T05:49:52.429348+00:00",
      "source": "combolists",
      "crawled_by": null,
      "flare_url": "https://app.flare.io/#/leaked_credential/combolists/9492d3cb916d17660421053e3a68674f"
    },
    "similar_items": []
  }
}