Check Entity for Dark Web Exposure — CyberTrace API

CyberTrace continuously monitors dark web credential dumps, stealer logs, and attack surface signals across the Indian payment ecosystem. Before this endpoint is live, you can join the waitlist to get early access and be notified the moment it launches.

CyberTrace is coming soon. This endpoint is not yet available. Join the waitlist at fraudtraceai.com to be notified when it launches.

Endpoint

All requests must include an Authorization: Bearer YOUR_API_KEY header. See Authentication for details.

Method: GET
Path: /v1/cyber/check
Base URL: https://api.fraudtraceai.com Check a merchant domain or entity for dark web credential exposure, breach data, and attack surface signals. Supply the domain or entity ID you want to investigate and CyberTrace returns a consolidated risk picture — credential leaks found in stealer logs and combolists, open attack surface findings from passive reconnaissance, and active dark web chatter referencing your merchant.

Request

Query Parameters

entity

string

required

The entity to check. Pass a domain name (e.g. merchant-domain.com) or an internal entity ID assigned within your platform. CyberTrace resolves the value against indexed breach sources and attack surface data.

Example Request

curl -G https://api.fraudtraceai.com/v1/cyber/check \
  --data-urlencode "entity=merchant-9271.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

import requests

response = requests.get(
    "https://api.fraudtraceai.com/v1/cyber/check",
    params={"entity": "merchant-9271.com"},
    headers={"Authorization": "Bearer YOUR_API_KEY"},
)
print(response.json())

const response = await fetch(
  "https://api.fraudtraceai.com/v1/cyber/check?entity=merchant-9271.com",
  {
    headers: { Authorization: "Bearer YOUR_API_KEY" },
  }
);
const data = await response.json();
console.log(data);

Planned Response

When status is EXPOSED, the response includes populated credential_leaks, attack_surface, and dark_web_mentions arrays alongside summary counts. When status is CLEAN, those arrays are empty and all counts are 0.

{
  "entity": "merchant-9271.com",
  "status": "EXPOSED",
  "credential_leaks": [
    {
      "source": "stealer-logs-2025",
      "data_types": ["email", "password"],
      "severity": "high",
      "detected_at": "2025-11-01"
    },
    {
      "source": "combolists-india-q4",
      "data_types": ["phone", "otp_seed"],
      "severity": "high",
      "detected_at": "2025-09-15"
    }
  ],
  "attack_surface": [
    { "finding": "admin_panel_exposed", "detail": "/wp-admin reachable", "severity": "high" },
    { "finding": "outdated_tls", "detail": "TLS 1.0 handshake accepted", "severity": "medium" },
    { "finding": "s3_public_listing", "detail": "Bucket listing enabled", "severity": "medium" }
  ],
  "dark_web_mentions": [
    { "source": "telegram", "detail": "Channel selling merchant API keys", "age_hours": 48 }
  ],
  "leak_count": 2,
  "attack_surface_count": 3,
  "dark_web_count": 1
}

{
  "entity": "safe-merchant.com",
  "status": "CLEAN",
  "credential_leaks": [],
  "attack_surface": [],
  "dark_web_mentions": [],
  "leak_count": 0,
  "attack_surface_count": 0,
  "dark_web_count": 0
}

Response Fields

entity

string

The entity value you passed in the request, echoed back for correlation.

status

string

Overall exposure verdict for this entity. Possible values:

EXPOSED — one or more active signals found across leaks, attack surface, or dark web sources.
CLEAN — no signals found at the time of the check.

credential_leaks

array

List of credential leak records found in indexed breach sources, stealer logs, and combolists that reference this entity.

Show credential_leaks[n] fields

source

string

The breach source or dataset name where this leak was identified (e.g. stealer-logs-2025, combolists-india-q4).

data_types

array of strings

The categories of data exposed in this leak. Common values include email, password, phone, otp_seed, upi_id.

severity

string

Risk severity of this individual leak record. One of high, medium, or low.

detected_at

string (date)

ISO 8601 date (YYYY-MM-DD) on which this leak was first detected in the CyberTrace index.

attack_surface

array

Passive reconnaissance findings that indicate exposed or misconfigured infrastructure belonging to the entity.

Show attack_surface[n] fields

finding

string

A machine-readable finding identifier. Examples: admin_panel_exposed, outdated_tls, s3_public_listing, open_port_exposed.

detail

string

A human-readable description of the specific finding (e.g. "/wp-admin reachable", "TLS 1.0 handshake accepted").

severity

string

Risk severity of this finding. One of high, medium, or low.

dark_web_mentions

array

Active dark web and underground channel references that name or implicate this entity.

Show dark_web_mentions[n] fields

source

string

The dark web or underground platform where the mention was observed (e.g. telegram, forum, paste_site).

detail

string

A summary of what was observed (e.g. "Channel selling merchant API keys").

age_hours

integer

How many hours ago this mention was first observed by CyberTrace monitoring.

leak_count

integer

Total number of credential leak records returned in credential_leaks.

attack_surface_count

integer

Total number of attack surface findings returned in attack_surface.

dark_web_count

integer

Total number of dark web mentions returned in dark_web_mentions.

Use Case

Fraud typically follows compromise — a merchant’s credentials leak, attackers gain access, and fraudulent transactions appear days or weeks later. By the time your platform detects a fraud pattern, the damage is done. CyberTrace lets you move the detection window upstream. Call this endpoint as part of your merchant onboarding checks, run it on a scheduled basis across your merchant network, or trigger it reactively when a merchant reports suspicious activity. A response showing active stealer-log matches or live Telegram chatter referencing that merchant’s API keys is a strong signal to freeze the account, rotate credentials, and open an investigation — before fraud hits.

For high-value merchants, consider scheduling a daily sweep using this endpoint. An EXPOSED result with age_hours under 72 on a dark web mention indicates a very fresh signal that warrants immediate action.

CyberTrace indexes breach data with a focus on Indian payment ecosystem entities — UPI merchants, payment aggregators, fintech partners, and banking correspondents. Coverage will expand at launch.

Overview

MuleTrace

CyberTrace

Mobile Trace

Check Entity for Dark Web Exposure — CyberTrace API

Endpoint

Request

Query Parameters

Example Request

Planned Response

Response Fields

Use Case

​Endpoint

​Request

​Query Parameters

​Example Request

​Planned Response

​Response Fields

​Use Case

Endpoint

Request

Query Parameters

Example Request

Planned Response

Response Fields

Use Case