Search an email, IP or username
Find out with a single search whether a person or machine appears in leaks.
Choose the target kind
kind is the type of the value you search: email, ip, hwid, pc, file, url, username (also domain and keyword). ip accepts one IPv4 address or a /16–/32 CIDR. Use at least 4 characters for pc, file, and url; do not send wildcards.
curl -G "https://api.darkradar.com/api/public/v1/hunter/search" \ -H "x-api-key: $DARKRADAR_API_KEY" \ --data-urlencode "kind=email" \ --data-urlencode "[email protected]"
curl -G "https://api.darkradar.com/api/public/v1/hunter/search" \ -H "x-api-key: $DARKRADAR_API_KEY" \ --data-urlencode "kind=ip" \ --data-urlencode "value=203.0.113.0/24"
curl -G "https://api.darkradar.com/api/public/v1/hunter/search" \ -H "x-api-key: $DARKRADAR_API_KEY" \ --data-urlencode "kind=file" \ --data-urlencode "value=employees.xlsx" \ --data-urlencode "country=TR" \ --data-urlencode "hasCookies=true"
Read the response
Each match lists exposed fields and first/last seen dates. summary adds country and infostealer family distributions plus card, wallet, cookie, and service flags. Secrets remain masked (secretMasked).
{
"success": true,
"data": {
"items": [
{
"matchRef": "64b1f0c2a9e4d21f8c3b9a40",
"source": "infostealer",
"exposedFields": [
"email",
"password"
],
"secretMasked": "Ya******23",
"firstSeenAt": "2026-08-30T00:00:00.000Z",
"seenAt": "2026-08-30T00:00:00.000Z"
}
],
"total": 1,
"infections": [],
"infectionTotal": 0,
"summary": {
"matches": 1,
"infections": 0,
"countries": {},
"stealerFamilies": {},
"firstSeenAt": "2026-08-30T00:00:00.000Z",
"lastSeenAt": "2026-08-30T00:00:00.000Z",
"hasWallet": false,
"hasCard": false,
"hasCookies": false,
"hasServices": false,
"hasFiles": false
},
"partial": false,
"pageInfo": {
"hasNext": true,
"nextCursor": "eyJ0IjoiMjAyNi0wOC0zMFQwMDowMDowMC4wMDBaIn0"
},
"rateLimit": {
"remaining": 19,
"limit": 20
}
}
}Searches count toward the per-minute limit; keep the results on your side and do not repeat the same search.
Check whether a password was exposed
This endpoint requires explicit hunter:password scope. The server hashes the password immediately; plaintext is absent from request history, audit records, and the database. The response contains only counts and a domain distribution.
curl -X POST "https://api.darkradar.com/api/public/v1/hunter/password" \
-H "x-api-key: $DARKRADAR_API_KEY" \
-H "content-type: application/json" \
--data '{"password":"kontrol-edilecek-parola"}'