Stealer Log Monitoring and API for Your Domains
Infostealer malware copies saved passwords from a person's device and the logs are traded in bulk. We index them, check them against your domains and tell you which domain was hit.
What a stealer log is, and why it is not a breach
A breach is a company losing a file. A stealer log is one person's device losing everything saved in its browser: logins for work, banking, email, all together, with the site each one belongs to. That is why a stealer-log hit on a work address is urgent: the attacker already has the password that goes with it, and often the session cookie too.
The largest single set in our index, AlienStealerLogs, holds 299,646,818 email addresses.
What you get when a domain is hit
- The domain and the number of addresses on it that appear, never the addresses themselves in the alert.
- The dataset name and the three dates: when the log was captured, when it was added to our index, and when we alerted you.
- Marked as stealer-log data, so the first step is to treat the device as unsafe, not only to reset the password.
Monitoring and API, the same data
Monitoring
Add domains, get alerts: email on the $99 tier, the account webhook and JSON feeds from $243. Slack and Teams delivery, alert rules per domain, and weekly to quarterly CSV reports with the domain on every row.
API
Every plan includes API access. Query a domain and get the exposure facts back: which datasets, when, what data categories, how many addresses. Under 100 ms for 99% of requests, measured. Official SDKs in 8 languages.
For MSSPs: one integration, every client
One account, one key and one domain quota cover every client domain. The alert names the domain; routing to the right client is done on your side from that field. Partners put their own branding on the reports they hand clients. See xonThreatIntel+ for MSSPs and how 50 clients run on one integration.
Side by Side With Legacy Vendors
Stealer-log coverage, side by side
Enterprise-grade breach data at a fraction of legacy threat-intel pricing, starting at $99/mo. Card checkout, partner agreement and DPA signed during onboarding. Most partners onboard the same day.
Plans That Scale With Your Client Base
Start with 10 domains at $99/mo. Add more as you grow. Scale plans from 50 domains to thousands
Basic
Growth
Ultimate
| Compare plans | Basic $99 /mo | MOST POPULAR Growth $243 /mo | Ultimate $447 /mo |
|---|---|---|---|
| Domains monitored | 10 | 25 | 50 |
| Data delivery | API + CSV | API + JSON + CSV | API + JSON + CSV |
| Alerts after indexing (<15 min) | Email + webhooks | Email + webhooks | |
| CXO dashboards | |||
| Deep dive analysis | — | ||
| Support response | Email (next business day) | Slack + email (same day) | Priority (4 business hours) |
| Custom integration support | — | — | |
| Threat intel advisory sessions | — | — | |
| 99.99% uptime SLA | Standard | Standard | Credit-backed |
All plans include: cancel anytime, monthly billing, and a 30-day money-back guarantee. Checkout is self-serve and onboarding starts immediately, so most partners are live the same day.
- Everything in Ultimate
- Volume discounts from 50 domains
- One partner agreement across the whole portfolio
- Invoice billing and annual terms available
By purchasing you agree to our Terms of Service and Privacy Policy.
For comparison: SpyCloud's MSSP program is sales-gated with no published pricing. White-label and multi-tenant access are included in every xonPlus tier.
Frequently asked questions
From the blog
All posts →
Stealer Logs, Explained for MSSPs
What a stealer log is, how it differs from a breach dump, and what monitoring for one can honestly tell you. With our own catalog numbers.
Infostealer Check for Your Domain: What Logs Show, What to Do
A stealer-log hit on your domain usually means an infected browser, not a breached company. What the row shows, what it can't, the three dates on it, and what to do, in order.
Multi-Tenant Dark Web Monitoring: 50 Clients, One Integration
One account, one API key and one signed webhook for every client domain. The client map, alert attribution and dedupe, a priority rule, per-client reports and the cost per client.
Start Offering Breach Monitoring Before Your Competitors Do
Live in under 1 hour. Plans from $99/mo. 30-day money-back guarantee.