Free-target search

Leak search by domain, email, IPv4/CIDR, HWID, computer name, filename/path, URL, username, keyword, domain with port (`darkradar.com:8443`), domain with scheme (`ftp://darkradar.com`) or file extension (`.kdbx`). CIDR prefixes must be /16–/32. `pc`, `file`, and `url` require at least 4 characters and reject wildcards. With `site`, an email or username search is narrowed to that site and no infection list is returned. For the next page, send the response `pageInfo.nextCursor` as `cursor`. Searching spends no credits. `partial: true` means the search hit its time limit and results may be incomplete. Secrets are masked.

GET/v1/hunter/search

GETFree-target search

curl -X GET "https://api.darkradar.com/api/public/v1/hunter/search?kind=domain&value=darkradar.com" \
  -H "x-api-key: $DARKRADAR_API_KEY"

Response

Success

{
  "success": true,
  "data": {
    "items": [
      {
        "matchRef": "64b1f0c2a9e4d21f8c3b9a40",
        "source": "infostealer",
        "exposedFields": [
          "email",
          "password"
        ],
        "secretMasked": "Ya******23",
        "firstSeenAt": "2026-08-30T00:00:00.000Z",
        "seenAt": "2026-08-30T00:00:00.000Z"
      }
    ],
    "total": 1,
    "infections": [],
    "infectionTotal": 0,
    "summary": {
      "matches": 1,
      "infections": 0,
      "countries": {},
      "stealerFamilies": {},
      "firstSeenAt": "2026-08-30T00:00:00.000Z",
      "lastSeenAt": "2026-08-30T00:00:00.000Z",
      "hasWallet": false,
      "hasCard": false,
      "hasCookies": false,
      "hasServices": false,
      "hasFiles": false
    },
    "partial": false,
    "pageInfo": {
      "hasNext": true,
      "nextCursor": "eyJ0IjoiMjAyNi0wOC0zMFQwMDowMDowMC4wMDBaIn0"
    },
    "rateLimit": {
      "remaining": 19,
      "limit": 20
    }
  }
}

Access

Scopehunter:search

Plan entitlementintel_hunter

Query parameters

Fields	Values
`kind` · string · required	Target type · Values: domain, email, ip, hwid, pc, file, url, username, keyword, port, scheme, ext · Example: `domain`
`value` · string · required	Value to search (2–256 chars) · Example: `darkradar.com`
`limit` · integer · optional	Max results (1–200) · Example: `50`
`cursor` · string · optional	Opaque next-page cursor
`site` · string · optional	Narrow an email or username search to one site · Example: `vpn.darkradar.com`
`country` · string · optional	Country code filter · Example: `TR`
`stealerFamily` · string · optional	Stealer family filter · Example: `Lumma`
`from` · string · optional	First seen from (ISO 8601) · Example: `2026-01-01`
`to` · string · optional	Last seen to (ISO 8601) · Example: `2026-09-20`
`hasWallet` · boolean · optional	Only results with/without wallet artifacts · Example: `true`
`hasCard` · boolean · optional	Only results with/without card artifacts · Example: `false`
`hasCookies` · boolean · optional	Only results with/without cookies · Example: `true`
`hasServices` · boolean · optional	Only results with/without service entries · Example: `true`

Responses

200Success

400Invalid request (malformed id, missing or invalid field)

401Key missing, invalid, expired or revoked

403Insufficient scope, no API access in plan, or product not enabled

404Record not found or not owned by this key’s firm

408The request exceeded its maximum response time

429The per-minute request limit for your firm was exceeded; wait the number of seconds in the `Retry-After` header

503Threat Investigation is temporarily unavailable; do not retry automatically, try again later yourself

Response limits

Page sizelimit · default 50 · max 200

Rate limit500 requests per 15 min · per IP

Threat Investigation20 requests per 1 min · per firm