Free OSINT tool
Infostealer check
See whether an email, username, or company domain shows up in infostealer malware logs, from Hudson Rock's free data.
Runs Hudson Rock by Hudson Rock (Free API, attribution required). Not affiliated with the provider.
How Hudson Rock infostealer check works here
Infostealers are malware that copy saved passwords, cookies, and autofill data from an infected computer. Hudson Rock collects the logs these infections produce and offers a free lookup by email, username, or domain.
For an email or username you get each infected machine: the infection date, operating system, antivirus, and the top saved logins and passwords, masked by Hudson Rock before they reach us.
For a domain you get counts of infected employees and users, the company login pages that appear most in logs, and the malware families involved.
How to read the results
- Infected computer
- A machine whose stolen data includes this identifier. It may belong to the person or to someone who saved their login.
- Date compromised
- When the infection happened, not when the data was leaked or found.
- Employees / users
- For a domain: people with a company email login (employees) versus people who logged in to the company's site (users).
- Masked credentials
- Hudson Rock hides most characters. The full data is not available on the free lookup.
What this free check cannot tell you
- Covers infostealer logs only, not classic database breaches.
- Credentials are masked; you cannot see full passwords or cookies here.
- A hit means the identifier was on an infected machine, not that the person's own computer was infected.
When the free check is not enough
Hudson Rock covers infostealer logs with masked credentials. SearchIn's leak providers search database breaches and stealer logs and return the records themselves.
What people use it for
- Check whether your own accounts were caught by malware, and when
- Measure a company's exposure before a pentest or a vendor review
- Date an account takeover by matching it to an infection date
Other free tools
FAQ
Hudson Rock infostealer check, answered
Is this an official Hudson Rock tool?
It uses Hudson Rock's free public lookup and credits them. We pass through only the fields shown here and add nothing to their data.
What should I do if my email shows up?
Change the passwords for the accounts listed, starting with email and banking, turn on two-factor sign-in, and sign out of all sessions, because stolen cookies can bypass passwords. Then clean or rebuild the infected computer.
Why can't I see the full passwords?
Hudson Rock masks them on the free lookup. That is deliberate, and we cannot unmask them.
How is this different from Have I Been Pwned?
Have I Been Pwned lists database breaches: a company was hacked and its user table leaked. This covers infostealers: one person's computer was infected and everything saved on it was taken.
Do you store what I search?
No. The username, email, phone, or domain you enter is sent in the request body, never in a URL, and it is not logged. Results are cached for a few hours under a one-way hash of the input so a repeat search is fast, then they expire.
Why is this free?
Because the first pass should cost nothing. These checks use open-source tools and free public data. When a result needs commercial data, such as people-search modules or breach records, SearchIn runs those as paid lookups with a receipt.
Your first lookup is a minute away
Create a free account with a magic link and add credits when you're ready. Or try the live demo first, no account needed.
- Free account, no card
- Credits never expire
- Refund unused balance in 7 days