AIAIExposure Check

Both, and they're the same chain. The stealer log is the earliest thing you can see from outside; the rogue service account is what gets created a few steps later. We show you the first so you know to go looking for the second.

Then rotating the password changes nothing. Keys and custom model endpoints sit in config files on the same machine, and those files are now targeted by name. We flag which of your matches include a key rather than just a login.

Infostealer operators sell or leak their harvests. We collect from underground marketplaces, exposed C2 panels, and the Telegram channels where free samples get posted to advertise paid subscriptions — the same sources the attacker buying your credentials would use.

It means the address isn't in what we've collected. New logs surface constantly, and some never get distributed publicly at all. A clean result is a snapshot, not a guarantee — which is why continuous monitoring exists. It means no credential record matched: it doesn't cover non-human identities, service account keys or tokens that never touched a browser, which no credential feed can see.

No. Results only reach the mailbox that was checked, and repeated lookups across unrelated domains get rate-limited.

The check is scoped to corporate exposure, and personal mailboxes can't be tied to a domain we're able to report on. If your company genuinely runs on a consumer provider, contact us instead.