Snusbase
Breach and stealer-log search across Snusbase leak tables.
Snusbase searches leaked databases for emails, usernames, names, domains, and IPs — returning credential rows grouped by dump, with hashes, hosts, and related identity fields when present. Its public statistics, checked 22 September 2026, list 18,523,442,591 rows in 2,251 tables.
Capabilities
- Field-scoped search across email, username, name, domain, and IP
- Return records grouped by Snusbase table / dump name
- Surface plaintext passwords, hashes, hosts, and last-seen IPs
- Public index of 18,523,442,591 rows across 2,251 tables (checked 22 September 2026)
- Map SearchIn domain and IP queries to Snusbase
_domainandlastiptypes
Data
Snusbase’s public database statistics, checked 22 September 2026, list 18,523,442,591 rows in 2,251 tables. The row count is rows, not unique people. Snusbase puts a category in each table name. The largest groups by number of tables — not by number of rows — are gaming (341), social (215), hacking (193), store (119), tech (115), and Minecraft (95), out of 186 categories.
Email and domain columns appear on 2,018 tables. A hash column appears on 1,547 tables. A plaintext password column appears on 391. SearchIn queries email, username, name, domain, and IP.
What you get back
- Records grouped by leak table
- Masked password and hash fields with reveal toggle
- Filter across dumps and record fields
- Upstream hit count and latency metadata
UI workflow
Choose Email, Username, Domain, Name, or IP.
Select Snusbase.
Review grouped leak records and expand sensitive fields as needed.
Sample queries
| Input type | Query | Notes |
|---|---|---|
email | alex.rivera@example.com | Credential exposure check |
domain | example.com | Domain-wide leak footprint |
ip | 203.0.113.45 | IP-linked stealer / leak records |
Pricing
email $0.30 · username $0.30 · domain $0.30 · name $0.30 · ip $0.30
Best for
- Credential stuffing and account takeover assessments
- Stealer-log and combo-dump investigations
- Complementing DeHashed and LeakRadar breach views
How it works & why through OSINTverse
How the request runs
- 1Choose email, username, domain, name, or IP and select Snusbase.
- 2SearchIn translates the input — including domain to `_domain` and IP to `lastip` — into Snusbase search types for you.
- 3Matching rows return grouped by leak table, with passwords, hashes, hosts, and last-seen IPs where present.
- 4SearchIn masks sensitive fields by default and records upstream hit counts and query latency.
Coverage. As of 22 September 2026, Snusbase’s public statistics list 18,523,442,591 rows in 2,251 tables. Table names include a category. The largest groups by table count are gaming, social, hacking, store, tech, and Minecraft.
Why route Snusbase through OSINTverse
- ·SearchIn handles the Snusbase search-type mapping, so a plain domain or IP query just works.
- ·Stealer-log and combo-dump rows are grouped by table with secrets masked until you choose to reveal them.
- ·Pairs directly with DeHashed in one bulk run for overlap and corroboration checks.
| Snusbase directly | Through OSINTverse | |
|---|---|---|
| Getting started | Snusbase requires its own account and paid plan, with an API key issued from their dashboard. | Sign in, top up from $10, and run Snusbase the same minute — no vendor contract, seat, or sales call. |
| What a query costs | Plan, credit pack, or contract pricing set by the vendor and paid up front. | Pay per query from your prepaid balance — Snusbase starts at $0.30 for email lookups, with the exact price shown before you run it. |
| Failed lookups | Handled under the vendor's own credit and refund policy. | Automatically refunded to your wallet — a search that fails upstream after billing is not charged. |
| Output format | A vendor-specific response shape you normalise and render yourself. | Normalised result panels plus the raw JSON, returned by the same POST /v1/search contract as every other integration. |
| Cross-source work | Copy-paste between vendor dashboards to follow a lead into another dataset. | Results join one case graph, so you can pivot an entity into any of the other 16 integrations in a click. |
| Running it for a team | Per-seat or per-account access, billed and administered per analyst. | One shared team wallet with roles, provider allowlists, enforced MFA, and audit history — no per-seat fee. |
| Volume work | Script the vendor API yourself, including retries, polling, and rate handling. | Bulk search takes up to 50 queries across selected providers in one submission (max 100 jobs), with per-job status and partial-failure handling. |
One wallet, no subscriptions
Top up prepaid USD from $10 and spend it a query at a time across all 17 integrations. No monthly fee, no seat count — and the balance never expires.
Failed searches are refunded
If an upstream provider errors or times out after the charge, the search is marked refunded and the money goes back to your wallet automatically.
One API for every source
The same POST /v1/search contract and x-api-key header work for every integration, so adding a source to your automation is a one-word change.
Cases and pivot graph
Results land in a named case you can reopen. Entities become graph nodes you can pivot from into any other integration without retyping.
Team wallets and controls
Share one balance with roles, provider allowlists, enforced MFA, and audit history — instead of buying a vendor seat for every analyst.
Exports built in
Download any result as JSON, CSV, or PDF, and export the case graph as PNG, SVG, entities CSV, or graph JSON.
Good to know
- A password or hash on a row is historical dump data. It does not confirm the credential still works.
- Category cards count tables, not rows. Email and domain columns are on 2,018 tables, hashes on 1,547, and plaintext passwords on 391. Figures are from 22 September 2026.
- Snusbase also accepts password and hash as search types. SearchIn queries email, username, name, domain, and IP.
- Host and last-seen IP fields are leads from the dump, not proof of a current address.
API example
$0.30 per query. The Example tab is free sample data. The Try it tab runs a real search and charges the active workspace wallet at the same rates as the dashboard.
Records
3
Breach rows returned
Databases
2
Distinct breach sources
Upstream
31714ms
Search latency
curl -X POST "https://apiv1.osintverse.com/v1/search" \ -H "Content-Type: application/json" \ -H "x-api-key: ov_your_api_key" \ -d '{"provider":"snusbase","input_type":"email","query":"alex.rivera@example.com"}'Invalid provider + input_type pairs return HTTP 422. Confirm combinations with GET /v1/providers or the pricing matrix.
Run this in the SearchIn UI or create an API key. Full HTTP reference: search workflow. Marketing overview: Snusbase integration.