What this capability area answers
“Has anyone at this company — or anyone using this company’s apps — had credentials stolen by an infostealer?” Domain Intelligence endpoints search by domain rather than by individual email/username, and are the natural starting point for assessing an organization’s exposure.| Endpoint | Use it to… |
|---|---|
| Search Domains | Get raw matching credential/cookie records for a domain |
| Company Exposure | Same, but classified as employee / user / third-party, with SSO domain support |
| Domain Overview | Get headline counts (no raw records) for one or many domains at once |
| Assets Discovery | Enumerate URLs/apps seen on infected machines that had this domain’s credentials |
| Third-Party Risk | Find vendor/supply-chain domains co-harvested alongside this domain |
| Timeline | Weekly trend of breach volume for one domain |
| Top Exposed Domains | Global leaderboard of the most-exposed domains |
search:domain scope except Third-Party Risk
(search:advanced, pro/ultra) and Top Exposed Domains (any valid key).
The type field: employees vs. users
Many endpoints accept a type parameter:
login
email belongs to one of the searched domains (an “employee” of that
company) versus an external account that merely used a service on that
domain (a “user” — e.g. a customer account on acme-corp.com’s storefront).
employees— only logins@<searched-domain>(or a searched subdomain)users— only logins that are not on the searched domain, but the matched record (e.g. a session cookie or saved form) is for a URL on the searched domainboth(default) — no filtering by this classification
type semantics is reused by
Search Domains,
Company Exposure,
Assets Discovery, and
Search by Email.
Subdomains: subdomains vs. include_subdomains
POST /v1/domain/search (and /v1/domain/company, /v1/domain/assets)
accept two related parameters:
include_subdomains: true— include all subdomains of the searched domain(s)subdomains: ["mail", "vpn"]— restrict to specific subdomain labels
subdomains takes priority — include_subdomains is
ignored. This is a common integration mistake: setting
include_subdomains: true while also passing an (unintentionally
non-empty) subdomains array will silently restrict your results to just
those labels, not “all subdomains.”
Discovered subdomains you didn’t explicitly search for are masked on the
free tier — see Data Masking.