Stealer Exposure Check
Infostealer-infected machines holding a company's logins, and what to clean up first.
No domain checked yet
Enter a company domain, or try an example. Add a second domain to compare.
Side by side
| Measure | A | B |
|---|
Cleanup playbook
Built from the login pages in this result. Clean the infected device first: a stealer still running takes the new password and session cookie too.
What staff logins were hit
Staff login pages by system type, weighted by machines. Tap a bar to filter.
Stealer families
Malware that produced the logs naming this domain.
Infected machines
Antivirus and saved password strength on infected machines.
Usernames and passwords are never shown. Email lookups are not offered because they return data about one person.
Login pages hit and third-party domainsLogin pages hit
| Login URL | Type | Machines | Next step |
|---|
Third-party domains
Other services whose logins appeared on infected employee machines. Tap one to check it.
How the stealer exposure check works
Infostealer malware copies saved passwords, cookies and autofill data from a browser and uploads the bundle (a log) to the operator. Logs are sold and shared, and threat intelligence firms index which domains appear inside.
This page asks pwnsy for the domain, and pwnsy requests the aggregate counts from Hudson Rock's free Cavalier OSINT API, caching each answer for up to six hours. Each login URL is sorted into a type by pwnsy's URL rules (identity and SSO, VPN and remote access, mail, code and engineering, admin panel, business app, customer or partner portal, other), and the playbook is built from the types that appear.
How to read the result
- Red: at least one staff machine, with the latest staff infection in the last 90 days. Start with the playbook.
- Amber: staff machines infected longer ago, or customer machines only.
- Green: no matching logs in this source. Other collections may differ.
Each count is one infected machine, and one person can own several. Dates are infection dates, often weeks before the log surfaces. In the comparison table, red marks the larger of two counts.
Stealer exposure FAQ
Where does the stealer data come from?
From Hudson Rock's free Cavalier OSINT API, which indexes which domains appear in infostealer logs. pwnsy requests it on your behalf and caches each answer for up to six hours. Only aggregate counts and login URLs are shown.
What is the difference between employees and customers?
An employee count is an infected machine that held a login to the domain's staff systems, such as SSO, VPN or webmail. A customer count is an infected machine that held a login to the service the domain offers its users. Each count is one machine, and one person can own several.
Can I look up an email address or see passwords?
No. Email lookups are not offered because they return data about one person, and usernames and passwords are never shown. The check works on a company domain only.
Does zero mean the company is safe?
No. A zero means this one source has no matching logs. Other collections may hold logs it does not, and new logs surface every day, so check again later.
Why reset sessions before passwords?
Stealers take session cookies as well as passwords. On many systems a stolen cookie keeps working after a password change, so revoke sessions and refresh tokens first, then reset the password and MFA.
A zero is one source's answer. Revoke sessions per platform with the Session Kill Switch.