stealerlogs.orgby Seer

Stealer logs search by email and domain

Infostealer malware copies every password a browser has saved and sells them in bulk. Type an email address, username or company domain to see whether it turns up in those logs, which sites the logins were for and where the infected devices were.

What a result looks like

Each record is one login that an infected browser had saved: the site it was for, the email address or username, and the password. The check shows how many there are and a sample of three, with the login masked and the password left out.

Next to each one is the country the infected device was in and the date the record was added to the index. That date is when the log surfaced, which can be months after the infection itself.

A domain search works the same way for every address at a company, which is how security teams find staff whose devices were compromised.

Example record, made-up values
Site
accounts.google.com
Login
ja***@***.com
Password
on Seer
Device in
Brazil
Added
2 March 2025

Stealer logs, briefly

The full explanation

Taken from your device

A data breach is one company losing its database. A stealer log comes from your own computer, so it holds your logins for every site at once, from email and banking to work tools.

Cookies skip the password

Logs carry the browser’s session cookies too. A buyer can load them and arrive already signed in, past the password and the two-factor prompt.

Clean the device first

If a login of yours is in a log, change nothing until the infected device is cleaned, or the new passwords are stolen as well. What to do if you were found.

The malware behind the logs

All families
RedLine StealerFor years the most common source of stealer logs on the market.Lumma StealerThe stealer behind the fake “verify you are human” pages.VidarA long-running stealer, often delivered together with other malware.Raccoon StealerA low-cost stealer whose alleged operator was arrested in 2022.StealCA newer stealer that borrows from Vidar, Raccoon and RedLine.Atomic macOS StealerProof that Macs get infostealers too.

The full records are on Seer

This site shows how many stealer log records hold a login and a masked sample of them. Seer, which runs the check, shows every record in full: the saved logins and passwords, the cookies, the infected device and when the log was collected.

Seer also searches breach records and social accounts, so one email address shows everywhere it has leaked and every account it is linked to.

See stealer logs on Seer

  • Stealer log searchFull records from infected devices, by email, username, domain, password or IP address.
  • Breached credentialsWhich data breaches an email address or username appears in, and what leaked with it.
  • Social account searchThe accounts an email address, username or phone number is linked to across hundreds of sites.
  • Plans and pricingA free account to start, and plans for investigators and security teams.

Questions

What is a stealer log?

A stealer log is the bundle of data that infostealer malware copies off an infected computer: every password the browser saved, its cookies, autofill entries and saved cards, crypto wallets and details of the machine. The logs are sold and shared in bulk, and each one holds logins for dozens of sites at once.

How do I check if my email is in a stealer log?

Type the address into the search box. The check looks for saved logins that use it and shows how many there are, with the site each was saved for, the country of the infected device and when the record was added. It works the same way for a username or a company domain.

What does a result show?

For each record: the website the login was saved for, the login itself with most of it masked, the country of the infected device and when the record was added. The password is never shown here. Seer shows the full records to an account holder.

Is a stealer log the same as a data breach?

No. A data breach is one company losing its own database. A stealer log comes from your own device: the malware takes what your browser saved for every site, including session cookies that can skip a password and two-factor prompt. It is usually the more urgent of the two.

My email was found. What should I do?

Clean the infected device first, or new passwords will be stolen too. Then, from a clean device, change the passwords for the sites listed, sign out of every session and turn on two-factor authentication. The full steps are on the what to do page.

Is the check free?

Yes. Each visitor has five free checks a day, shared with Seer’s free check, and there is nothing to sign up for. A free Seer account gives more.

Will the person I search for find out?

No. Nothing is sent to the address you search and nobody is notified.

Can I search my company’s domain?

Yes. Enter the domain, such as example.com, and the check counts saved logins that use an address at that domain, which is how a security team finds staff whose devices were infected.