Changelog

v2.4.10 Oct 16, 2026

• new A refreshed About page with screenshots of the platform, a gallery of the five report cover designs, and new sections on Query Console, Investigate, white-label reports, the browser extension and the API.
• new A new "How do I..." section in the FAQ: where to edit your report branding, the cover designs, generating a PDF report, getting more credits, API access on Researcher and Power User, Demo Mode, project sessions, alerts and the browser extension.
• improved The FAQ answers on credits and the API now reflect current pricing, including top-ups and which calls use credits, and link to the API reference.
• fixed The stealer log total on the About page showed 0. It now counts every stealer log category.

v2.4.9 Oct 16, 2026

• new White-label PDF reports: accounts with the white-label add-on can now brand their own reports from the new Report Branding tab on their profile. Set your company name, website, contact email, accent colour, cover logo and small logo.
• new Choose your report's cover: five first-page designs - Night grid, Paper grid, Split column, Findings band (datasets by severity right on the cover) and Diamond line.
• new Live preview of your report's first page while you edit your branding, before anything is saved.

v2.4.8 Oct 16, 2026

• new API: /api/v2/generate_report/ can build a report from every section: leaked credentials, stealer logs, ULP combolists, personal records, LinkedIn, Facebook, subdomains, DNS, TLS certificates and domain registration. Send report_selections=all for everything. Report generation is enabled per API account.
• improved API: an unknown endpoint now returns a JSON error ([{"Error": "Unknown endpoint."}]) instead of a web page, and a request missing its trailing slash is redirected without losing a POST body.
• improved The API reference only lists the endpoints your API host can use.

.1 Oct 16, 2026

• improved API reference: the sidebar and the Home link go back to the main site (Universal Search, About, FAQ and Changelog), and the sign-in buttons are no longer shown on API pages.
• improved Each customer API host shows its own API reference, documenting the search tags and tables enabled for it.

v2.4.7 Oct 16, 2026

• security Changing your email address now sends a confirmation link to the new address. The change applies only once you open it, and your old address is told about it.
• security Email verification links now expire after 24 hours. Opening an expired sign-up link sends you a fresh one.
• fixed Unsubscribe, password reset and verification links that are invalid or expired now show a clear page instead of an error.
• fixed A search page that fails to load is no longer charged.
• fixed Domain activation by DNS TXT record checks every TXT record on the domain, is quicker, and no longer leaves a request approved without the domain being added.
• improved PDF reports now include certificate common names, and the password date check covers every year up to next year.
• new If an API report can't be generated, its recipients get an email saying so.
• fixed Stealer log file downloads only include that log's own files and use far less memory.
• fixed Loading spinners and blurred results no longer get stuck when a request fails, on the profile, search, enterprise dashboard, sessions, plan change and screenshot views.
• fixed After a delete fails, the delete button asks "Sure?" again instead of deleting on the next click.

v2.4.6 Oct 15, 2026

• security CSV exports are protected against spreadsheet formulas: a cell that Excel, LibreOffice or Google Sheets would run as a formula is saved as text. Phone numbers and plain numbers are left as they are.
• fixed Stealer Log searches by IP now return every matching credential instead of stopping after the first 10 logs.
• improved TLD Lookup is much faster: tesla.* returns in under a second instead of 14 seconds, and very large lookups such as gmail.* no longer fail.
• fixed A PDF report no longer leaves out a section silently when its data can't be loaded. It fails with a clear message so you can run it again.
• fixed PDF reports no longer get stuck on Processing.
• improved Exports, scans and tools that are running during an update now finish instead of being stopped.

v2.4.5 Oct 15, 2026

• new Keep me signed in on this device: tick the box at sign-in and a trusted device skips the 2FA prompt for 30 days.
• security Leaked and stealer log values such as passwords, usernames and page titles are always shown as plain text and can no longer run as code in your browser.
• security Password masking and permission checks were tightened across search results, stealer logs and the API.
• security Browser extension: the old password sign-in is retired, and extension lookups are limited to 100 per account per day.
• improved Spaces at the start or end of a search term or domain request are removed automatically. Password searches are kept exactly as typed.
• fixed Running the same search again within a day is no longer charged twice when the term contains a space or a plus sign.
• fixed Searches, reports, asset additions and API calls made at the same moment can no longer spend the same credit twice.
• fixed Credit refunds are no longer lost, and refunds of purchased top-up credits go back to your top-up balance instead of the daily allowance.
• fixed Assets can be removed once their 7-day hold has passed. The check was wrong and blocked every removal.
• fixed Query Console and Investigate now count toward the daily search limit, like the Search Console.
• fixed Cached API sample results are now charged and logged like fresh ones.

v2.4.4 Oct 13, 2026

• fixed Bug Fixes

v2.4.3 Oct 13, 2026

• fixed Bug fixes

v2.4.2 Oct 13, 2026

• new Custom API: a new option for very high volume or custom limits. Contact us from the Subscriptions page to set up volume pricing.
• new Daily search limits can now be removed with approval. The Subscriptions page and FAQ explain how to ask for it.
• improved Search results show the dataset name in a header above the table. The PDF and CSV buttons are gone from the toolbar. Table text is larger and now uses JetBrains Mono, which is easier to read for passwords and hashes.
• improved Stealer log screenshot thumbnails now show a loading spinner right away, then a "taking longer" note, and offer a retry if the image can't be fetched.
• fixed Invoice History no longer shows dollar amounts with two dollar signs.

v2.4.1 Oct 12, 2026

• fixed Fixed the view box for the main icon.

v2.4.0 Oct 12, 2026

• new ULP Combolists is a new dataset under Credentials: URL, login and password lines compiled from infostealer output, searchable by domain, email, username, password and free text, with its own tab, result count and CSV export.
• new ULP Combolists also appears in the top statistics carousel, in PDF reports, as graph pivots in Canvas, as a source in the Query Console, in public search counts, and in Asset Monitoring and Email Monitoring alerts.
• new The About page and FAQ now explain how ULP Combolists differ from Leaked Credentials (breach data) and Stealer Logs (full logs from an infected machine).
• new API: ULP Combolists is available as the stealer_ulp table on the query and meta_counts endpoints, in sample mode, and in CSV output.
• new API: big results can be paged. Send page_size (up to 5,000) and read the X-Next-Cursor response header, then send it back as cursor for the next page. A search with more than 5,000 results in one table is paged automatically at 1,000 rows. Credits are charged once, on the first page.
• new API: a new /api/v2/bins/ endpoint. GET lists your BIN client IDs and POST with a client_id returns the BIN exposure data. The existing BIN options on the query endpoint keep working.
• new Password hash lookups now cover every hash type we hold: MD5, SHA1, SHA256, SHA512, NTLM and LANMAN. The type is detected from the hash length, and the API pwcheck endpoint accepts all of them.
• new Passive Tools PW Hash Lookup has a hash type dropdown (Auto-detect, MD5, SHA1, SHA256, SHA512, NTLM, LANMAN), a live hint of what your hash looks like, and a clear message when the hash does not match the type you chose.
• improved API: large results return much faster. A 2,300-row stealer result that took 13 seconds now takes about 1.4 seconds.
• improved The API reference (Swagger) is easier to read: more space between lines around code, a full-width introduction, no stray text box, and the years and cursor fields start empty so they are not sent by accident.
• improved The credits meter now appears with the page instead of a moment later, shows your last known balance straight away, and lines up with the other top-bar buttons.
• fixed The Last Search button no longer puts the run count into the search box (for example nicu.com.au x7). It uses just the domain.
• fixed API CSV output works again for every table, with stealer and ULP columns filled in, including cursor-paged CSV.
• fixed Email Monitoring alerts had stopped sending. They are fixed: the first run only records where each address stands and sends nothing, then you get a weekly email listing only newly exposed records.
• fixed Leaked credential rows with SHA256 or SHA512 hashes now show the password when we know it, and upper-case hashes are matched too.

v2.3.5 Oct 9, 2026

• new The top bar now shows search credits left, with a usage bar against the plan allowance, a low-credit warning, and a tooltip with the renewal date and any purchased credits.
• new Clicking the search box now suggests your recent and most-used domains, emails, IPs, ASNs, AS orgs and usernames, filtered as you type; passwords and card data are never suggested.
• new A top-bar icon with a count appears while a CSV export or PDF report is being built, clears when it finishes, and opens the Data Exports window when clicked.
• new Result table headers are now clickable to sort the rows on the current page (ascending, descending, original order), with the sort kept while paging.
• new Saved DataPoint values now show a star in every results table and in later searches, and removing a saved value from the kebab works.
• new Saved DataPoints now record the table, column, source and search they came from.
• new You can add a note to any saved data point from the Saved DataPoints window or the kebab's "Note…" item.

v2.3.4 Oct 7, 2026

• improved The hash database was rebuilt on a faster, redundant index, so hash searches return quicker.
• improved Password hash lookups now cover more hash types: NTLM, LM, SHA-256 and SHA-512 alongside MD5 and SHA-1.
• new The version in the footer now matches the release (for example 2.3.4) and always reflects what is actually deployed
• improved Subdomain index was rebuilt to provide more reliable results.

v2.3.3 Oct 6, 2026

• improved Certificate search now runs on one consolidated Certificates dataset. Each certificate is stored once, with about 2.4 billion duplicate records removed.
• improved The 31 separate certificate-log datasets are now a single Certificates dataset in results, reports and exports.
• new Certificate results in the Query Console can be broken down by TLD and by the certificate log they came from.

v2.3.2 Oct 3, 2026

• new This Changelog page, so you can see what ships as we release it.
• new Notifications are stored and browsable from the top-bar bell, with a separate tab for site-wide announcements.
• new Minimised tool and host windows now dock in a tray at the bottom of the console.
• new User Admin now shows a user's recent in-app credit usage alongside their history.
• improved Insight analytics now opens inside the main console, with the left sidebar and top bar.
• improved Reorganised the left navigation and made the Site Management panels consistent.
• improved Reworked the sign-in page with clearer progress and error messages instead of appearing to do nothing.

v2.3.1 Sep 28, 2026

• new Query Console: one query language across every dataset, with saved queries, live streams, pipes (count-by and top), and right-click pivots.
• new Investigation Canvas rebuilt: minimap, find/filter, expand a node in place, and pivots across every dataset (not just infrastructure).

v2.3.0 Sep 10, 2026

• new A full visual redesign of the public site, sign-in, and the search console around a new design system.
• new Rebuilt PDF report: summary-led, renders fully offline with self-hosted fonts, per-user white-label branding, real sample tables with secrets masked, and drag-to-order sections.
• new Rebuilt Data Exports: CSV streams straight to disk with a fixed column registry (rows can no longer come out short) and clearer per-row charging.
• improved Much faster search: parallel counts, per-page lookups, and retiring legacy stealer logs from the index.
• improved Search console polish: a compact grouped tag picker with filter and keyboard nav, a themed CSV export window with a live summary, and Stealer Host Details shown as a file-manager tree.
• improved Active and Passive Tools rebuilt from one registry; fixed the TLD lookup returning nothing.
• improved Site Management now reports Extension-API and all-API usage, and what the search figures exclude.
• improved Performance pass across the app: indexed the columns we filter on, trimmed round-trips per request, and made CSV export one query instead of one per row.
• improved Rebuilt the API documentation and the account email flows.
• fixed Websocket stability (no more disconnects every few seconds), the two-factor sign-in flow, and the realtime (ASGI) server.

v2.2.9 Aug 15, 2026

• new Massive overhaul on the front and backend of Leaked.Domains. Lots of great updates incoming.