Stealer Exposure Check
See how many of a company's staff and customer machines were infected by infostealer malware while holding its logins, which login pages were hit, and what to clean up first. Counts only.
Usernames and passwords are never shown. Email lookups are not offered because they return data about one person.
No domain checked yet
Enter a company domain above, or try one of the examples. Add a second domain to compare two companies.
Side by side
| Measure | A | B |
|---|
Cleanup playbook
Built from the login pages in this result. Clean the infected device first: a stealer still running takes the new password and session cookie too.
What staff logins were hit
Employee login pages grouped by system type, weighted by infected machines. Tap a bar to filter the table.
Stealer families
Which malware produced the logs that mention this domain.
Infected machines
Antivirus seen on the infected machines, and saved password strength as graded by the data source.
Login pages hit
| Login URL | Type | Machines | Next step |
|---|
Third-party domains
Other services whose logins appeared on infected employee machines. Tap one to check it.
How the stealer exposure check works
Infostealer malware copies saved passwords, cookies and autofill data from a browser and uploads the bundle (a log) to the operator. Logs are sold and shared, and threat intelligence firms index which domains appear inside.
This page asks pwnsy for the domain, and pwnsy requests the aggregate counts from Hudson Rock's free Cavalier OSINT API, caching each answer for up to six hours. Each login URL is sorted into a type by pwnsy's URL rules (identity and SSO, VPN and remote access, mail, code and engineering, admin panel, business app, customer or partner portal, other), and the playbook is built from the types that appear.
How to read the result
- Red: at least one staff machine, with the latest staff infection in the last 90 days. Start with the playbook.
- Amber: staff machines infected longer ago, or customer machines only.
- Green: no matching logs in this source. Other collections may differ.
Each count is one infected machine, and one person can own several. Dates are infection dates, often weeks before the log surfaces. In the comparison table, red marks the larger of two counts.
Stealer exposure FAQ
Where does the stealer data come from?
From Hudson Rock's free Cavalier OSINT API, which indexes which domains appear in infostealer logs. pwnsy requests it on your behalf and caches each answer for up to six hours. Only aggregate counts and login URLs are shown.
What is the difference between employees and customers?
An employee count is an infected machine that held a login to the domain's staff systems, such as SSO, VPN or webmail. A customer count is an infected machine that held a login to the service the domain offers its users. Each count is one machine, and one person can own several.
Can I look up an email address or see passwords?
No. Email lookups are not offered because they return data about one person, and usernames and passwords are never shown. The check works on a company domain only.
Does zero mean the company is safe?
No. A zero means this one source has no matching logs. Other collections may hold logs it does not, and new logs surface every day, so check again later.
Why reset sessions before passwords?
Stealers take session cookies as well as passwords. On many systems a stolen cookie keeps working after a password change, so revoke sessions and refresh tokens first, then reset the password and MFA.
A zero is one source's answer. Revoke sessions per platform with the Session Kill Switch.