> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fraudtraceai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Check Entity for Dark Web Exposure — CyberTrace API

> Detect dark web credential leaks, breach data, and attack surface signals for any merchant domain or partner entity using CyberTrace.

CyberTrace continuously monitors dark web credential dumps, stealer logs, and attack surface signals across the Indian payment ecosystem. Before this endpoint is live, you can join the waitlist to get early access and be notified the moment it launches.

<Warning>
  **CyberTrace is coming soon.** This endpoint is not yet available. Join the waitlist at [fraudtraceai.com](https://fraudtraceai.com) to be notified when it launches.
</Warning>

## Endpoint

<Note>
  All requests must include an `Authorization: Bearer YOUR_API_KEY` header. See [Authentication](/authentication) for details.
</Note>

**Method:** `GET`\
**Path:** `/v1/cyber/check`\
**Base URL:** `https://api.fraudtraceai.com`

Check a merchant domain or entity for dark web credential exposure, breach data, and attack surface signals. Supply the domain or entity ID you want to investigate and CyberTrace returns a consolidated risk picture — credential leaks found in stealer logs and combolists, open attack surface findings from passive reconnaissance, and active dark web chatter referencing your merchant.

## Request

### Query Parameters

<ParamField query="entity" type="string" required>
  The entity to check. Pass a domain name (e.g. `merchant-domain.com`) or an internal entity ID assigned within your platform. CyberTrace resolves the value against indexed breach sources and attack surface data.
</ParamField>

### Example Request

<CodeGroup>
  ```bash cURL theme={null}
  curl -G https://api.fraudtraceai.com/v1/cyber/check \
    --data-urlencode "entity=merchant-9271.com" \
    -H "Authorization: Bearer YOUR_API_KEY"
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      "https://api.fraudtraceai.com/v1/cyber/check",
      params={"entity": "merchant-9271.com"},
      headers={"Authorization": "Bearer YOUR_API_KEY"},
  )
  print(response.json())
  ```

  ```javascript Node.js theme={null}
  const response = await fetch(
    "https://api.fraudtraceai.com/v1/cyber/check?entity=merchant-9271.com",
    {
      headers: { Authorization: "Bearer YOUR_API_KEY" },
    }
  );
  const data = await response.json();
  console.log(data);
  ```
</CodeGroup>

## Planned Response

When `status` is `EXPOSED`, the response includes populated `credential_leaks`, `attack_surface`, and `dark_web_mentions` arrays alongside summary counts. When `status` is `CLEAN`, those arrays are empty and all counts are `0`.

<CodeGroup>
  ```json EXPOSED theme={null}
  {
    "entity": "merchant-9271.com",
    "status": "EXPOSED",
    "credential_leaks": [
      {
        "source": "stealer-logs-2025",
        "data_types": ["email", "password"],
        "severity": "high",
        "detected_at": "2025-11-01"
      },
      {
        "source": "combolists-india-q4",
        "data_types": ["phone", "otp_seed"],
        "severity": "high",
        "detected_at": "2025-09-15"
      }
    ],
    "attack_surface": [
      { "finding": "admin_panel_exposed", "detail": "/wp-admin reachable", "severity": "high" },
      { "finding": "outdated_tls", "detail": "TLS 1.0 handshake accepted", "severity": "medium" },
      { "finding": "s3_public_listing", "detail": "Bucket listing enabled", "severity": "medium" }
    ],
    "dark_web_mentions": [
      { "source": "telegram", "detail": "Channel selling merchant API keys", "age_hours": 48 }
    ],
    "leak_count": 2,
    "attack_surface_count": 3,
    "dark_web_count": 1
  }
  ```

  ```json CLEAN theme={null}
  {
    "entity": "safe-merchant.com",
    "status": "CLEAN",
    "credential_leaks": [],
    "attack_surface": [],
    "dark_web_mentions": [],
    "leak_count": 0,
    "attack_surface_count": 0,
    "dark_web_count": 0
  }
  ```
</CodeGroup>

### Response Fields

<ResponseField name="entity" type="string">
  The entity value you passed in the request, echoed back for correlation.
</ResponseField>

<ResponseField name="status" type="string">
  Overall exposure verdict for this entity. Possible values:

  * `EXPOSED` — one or more active signals found across leaks, attack surface, or dark web sources.
  * `CLEAN` — no signals found at the time of the check.
</ResponseField>

<ResponseField name="credential_leaks" type="array">
  List of credential leak records found in indexed breach sources, stealer logs, and combolists that reference this entity.

  <Expandable title="credential_leaks[n] fields">
    <ResponseField name="source" type="string">
      The breach source or dataset name where this leak was identified (e.g. `stealer-logs-2025`, `combolists-india-q4`).
    </ResponseField>

    <ResponseField name="data_types" type="array of strings">
      The categories of data exposed in this leak. Common values include `email`, `password`, `phone`, `otp_seed`, `upi_id`.
    </ResponseField>

    <ResponseField name="severity" type="string">
      Risk severity of this individual leak record. One of `high`, `medium`, or `low`.
    </ResponseField>

    <ResponseField name="detected_at" type="string (date)">
      ISO 8601 date (`YYYY-MM-DD`) on which this leak was first detected in the CyberTrace index.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="attack_surface" type="array">
  Passive reconnaissance findings that indicate exposed or misconfigured infrastructure belonging to the entity.

  <Expandable title="attack_surface[n] fields">
    <ResponseField name="finding" type="string">
      A machine-readable finding identifier. Examples: `admin_panel_exposed`, `outdated_tls`, `s3_public_listing`, `open_port_exposed`.
    </ResponseField>

    <ResponseField name="detail" type="string">
      A human-readable description of the specific finding (e.g. `"/wp-admin reachable"`, `"TLS 1.0 handshake accepted"`).
    </ResponseField>

    <ResponseField name="severity" type="string">
      Risk severity of this finding. One of `high`, `medium`, or `low`.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="dark_web_mentions" type="array">
  Active dark web and underground channel references that name or implicate this entity.

  <Expandable title="dark_web_mentions[n] fields">
    <ResponseField name="source" type="string">
      The dark web or underground platform where the mention was observed (e.g. `telegram`, `forum`, `paste_site`).
    </ResponseField>

    <ResponseField name="detail" type="string">
      A summary of what was observed (e.g. `"Channel selling merchant API keys"`).
    </ResponseField>

    <ResponseField name="age_hours" type="integer">
      How many hours ago this mention was first observed by CyberTrace monitoring.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="leak_count" type="integer">
  Total number of credential leak records returned in `credential_leaks`.
</ResponseField>

<ResponseField name="attack_surface_count" type="integer">
  Total number of attack surface findings returned in `attack_surface`.
</ResponseField>

<ResponseField name="dark_web_count" type="integer">
  Total number of dark web mentions returned in `dark_web_mentions`.
</ResponseField>

## Use Case

Fraud typically follows compromise — a merchant's credentials leak, attackers gain access, and fraudulent transactions appear days or weeks later. By the time your platform detects a fraud pattern, the damage is done.

CyberTrace lets you move the detection window upstream. Call this endpoint as part of your merchant onboarding checks, run it on a scheduled basis across your merchant network, or trigger it reactively when a merchant reports suspicious activity. A response showing active stealer-log matches or live Telegram chatter referencing that merchant's API keys is a strong signal to freeze the account, rotate credentials, and open an investigation — before fraud hits.

<Tip>
  For high-value merchants, consider scheduling a daily sweep using this endpoint. An `EXPOSED` result with `age_hours` under 72 on a dark web mention indicates a very fresh signal that warrants immediate action.
</Tip>

<Info>
  CyberTrace indexes breach data with a focus on Indian payment ecosystem entities — UPI merchants, payment aggregators, fintech partners, and banking correspondents. Coverage will expand at launch.
</Info>