---
title: "Leak and infostealer exposure of a domain: employee and user credentials seen in stealer logs (with last-seen dates and malware families), leak records mentioning the domain, and official breaches - aggregates only, never passwords or personal records"
method: POST
path: "/v1/exposure-check"
tags: ["SEO"]
---

# Leak and infostealer exposure of a domain: employee and user credentials seen in stealer logs (with last-seen dates and malware families), leak records mentioning the domain, and official breaches - aggregates only, never passwords or personal records

`POST /v1/exposure-check`

## Request

- Base URL: `https://agent.connskill.com` (the document declares no server; this is the origin it was published from)
- URL: `https://agent.connskill.com/v1/exposure-check`
- Auth: none declared

## Request body

- object
  - `domain` string, required: Domain to check, e.g. example.com (no e-mail addresses, no paths). Also accepted as "target" or "url".

## Response `200`

Report delivered

- object
  - `status` string
  - `domain` string
  - `infostealer` object
    - `employees` integer
    - `users` integer
    - `thirdParties` integer
    - `lastEmployeeCompromised` string
    - `stealerFamilies` object[]
      - `family` string
      - `count` integer
  - `leaks` object
    - `found` integer
    - `sources` object[]
      - `name` string
      - `date` unknown
  - `breaches` object[]
    - `name` string
    - `date` string
    - `accounts` integer
  - `verdict` object
    - `level` string
    - `reasons` string[]
  - `sourcesFailed` unknown[]
    - unknown

## Other responses

- `402`: Payment Required

---

[API](https://skmtc.dev/connskill/apis/connskill-growth-services.md) · [All operations](https://skmtc.dev/connskill/apis/connskill-growth-services/llms.txt) · [OpenAPI document](https://skmtc.dev/connskill/apis/connskill-growth-services/revisions/aae873ea0805?raw)