AlertsBar

Previous value: -"Counters as of the last daily rebuild. Windows count back from that rebuild, not from request time. Every _total/_month/_week is counted by INDEXATION date, not by when the leak or infection happened. staff = login is an address at this domain (employees); users = login belongs elsewhere but the record is for this domain's site (customers)."New value: +"Counters as of the last daily rebuild. Windows count back from that rebuild, not from request time. Every _total/_month/_week and both dates are by INDEXATION date, not by when the leak or infection happened. All counters and both dates are null when the domain is not in the index (no data - not the same as clean). staff = login is an address at this domain; users = login belongs elsewhere but the record is for this domain's site (customers). For public mailbox providers (e.g. gmail.com, ukr.net) staff means holders of mailboxes at that domain, NOT employees, and the numbers can be huge - do not present them as an employee compromise. Placeholder or test domains (e.g. example.com) also produce staff records that belong to nobody in particular."

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"Stolen browser session cookies, indexed all time. Non-zero means session-hijacking risk that a password reset alone does not fix."New value: +"Stolen browser session cookies, indexed all time. Non-zero means session-hijacking risk that a password reset alone does not fix. Cookies are counted here only; they are not included in exposure_samples_for_domain."

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Added value: +{
+  "description": "Date-time (format YYYY-MM-DD HH:MM:SS, UTC) when AlertsBar first indexed a record for this domain. Indexation date, not incident date - never say the domain was first leaked then. Null if the domain is not in the index.",
+  "type": [
+    "string",
+    "null"
+  ]
+}

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"Staff logins in unattributed heap of ULP bundles - no linkable breach, device or leak date. Credentials circulating in the wild."New value: +"Staff logins in unattributed heap of ULP (Url,Login,Password) bundles - no linkable breach, device or leak date. Credentials circulating in the wild."

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"Customer logins in unattributed heap of ULP bundles - no linkable breach, device or leak date."New value: +"Customer logins in unattributed heap of ULP (Url,Login,Password) bundles - no linkable breach, device or leak date."

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Added value: +{
+  "description": "Date-time (format YYYY-MM-DD HH:MM:SS, UTC) when AlertsBar last indexed a record for this domain. This is the domain's 'last updated' date and the only reliable freshness signal - samples are random and say nothing about recency. Say 'newly indexed', never 'newly leaked'. Null if the domain is not in the index.",
+  "type": [
+    "string",
+    "null"
+  ]
+}

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"Staff logins from infostealer-infected devices, indexed all time. Implies a compromised machine, not just a leaked password."New value: +"Staff logins from infostealer-infected devices, indexed all time. Implies a compromised machine, not just a leaked password. The credentials may be for any site, not only this domain's own systems."

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

Previous value: -[
-  "domain",
-  "breaches_total",
-  "breaches_month",
-  "breaches_week",
-  "cookies_total",
-  "cookies_month",
-  "cookies_week",
-  "stealers_staff_total",
-  "stealers_staff_month",
-  "stealers_staff_week",
-  "stealers_users_total",
-  "stealers_users_month",
-  "stealers_users_week",
-  "heap_staff_total",
-  "heap_staff_month",
-  "heap_staff_week",
-  "heap_users_total",
-  "heap_users_month",
-  "heap_users_week"
-]New value: +[
+  "domain",
+  "first_indexed_at",
+  "last_indexed_at",
+  "breaches_total",
+  "breaches_month",
+  "breaches_week",
+  "cookies_total",
+  "cookies_month",
+  "cookies_week",
+  "stealers_staff_total",
+  "stealers_staff_month",
+  "stealers_staff_week",
+  "stealers_users_total",
+  "stealers_users_month",
+  "stealers_users_week",
+  "heap_staff_total",
+  "heap_staff_month",
+  "heap_staff_week",
+  "heap_users_total",
+  "heap_users_month",
+  "heap_users_week"
+]

Previous value: -"A capped sample of exposure records. Metadata only - no credentials of any kind. This is a SAMPLE, never the full set: the number of records here says nothing about the true volume, which only exposure_counts_for_domain reports. Never describe the count of records in this response as the number of exposures."New value: +"A random capped sample of exposure records. Metadata only - no credentials of any kind. This is a SAMPLE, never the full set: the number of records here says nothing about the true volume, which only exposure_counts_for_domain reports. Never describe the count of records in this response as the number of exposures, and never infer how recent the domain's exposure is from this list."

Previous value: -"The sampled records, newest indexed first. Capped server-side; an empty array means nothing is indexed for this domain."New value: +"A random subset of up to 20 records per type, listed by indexed_at descending inside this response. NOT the newest records: a recent or old indexed_at here says nothing about the domain's overall recency - use last_indexed_at from exposure_counts_for_domain. Capped server-side; an empty array means nothing is indexed for this domain."

Previous value: -"Unix seconds, and its meaning follows type. stealers_*: ESTIMATED infection date - an estimate, so always say 'around' or 'estimated'. breaches: the date the breach was PUBLISHED, which is later than when it happened - say 'published', never 'happened'. heap_*: always null, never render it - say the leak date is unknown."New value: +"Unix seconds or null, and its meaning follows type. stealers_*: ESTIMATED infection date - an estimate, so always say 'around' or 'estimated'. breaches: the date the breach was PUBLISHED, which is later than when it happened - say 'published', never 'happened'. heap_*: always null (unknown) - never render it as a date, say the leak date is unknown."

Previous value: -"Unix seconds. When AlertsBar indexed this record. Always a fact, unlike estimated_incident_at. A recent indexed_at with an older estimated_incident_at means a long-standing compromise only just discovered - say 'newly discovered', never 'newly leaked'."New value: +"Unix seconds (UTC). When AlertsBar indexed this record. Always a fact, unlike estimated_incident_at. A recent indexed_at with an older estimated_incident_at means a long-standing compromise only just discovered - say 'newly discovered', never 'newly leaked'. Many breach records share one identical indexed_at because they were bulk-imported."

Previous value: -"The captured login with its LOCAL PART REDACTED, e.g. ...@company.com - only the domain part is real, and no address, name or individual is identified. This is what ties the record to the queried domain: for *_staff the domain part equals the queried domain, meaning an address at this organisation was found with credentials for url; for *_users it is an outside provider (gmail.com and such), meaning an external person's credentials for this organisation's site were taken. Use it to explain WHY a record belongs to this domain. The dots are a redaction, NOT a wildcard: this is one single account, never all addresses at that domain. Full logins are not available through MCP at all - they require domain ownership verification and an API key."New value: +"The captured login with its LOCAL PART REDACTED, e.g. ...@company.com - only the part after @ is real, and no address, name or individual is identified. This is what ties the record to the queried domain: for *_staff the domain part equals the queried domain, meaning an address at this domain was found with credentials for url; for *_users it is usually an outside provider (gmail.com and such), meaning an external person's credentials for this organisation's site were taken. For stealers_users the part after @ can also be a bare host label (e.g. ...@local) or missing entirely (just '...'), and letter case is as captured. Use it to explain WHY a record belongs to this domain. The dots are a redaction, NOT a wildcard: this is one single account, never all addresses at that domain. Full logins are not available through MCP at all - they require domain ownership verification and an API key."

Previous value: -"Opaque internal reference source feed or breach inside AlertsBar, shared by every record from it; quote it to identify the incident, not the individual row. Its only purpose is follow-up - the user can quote it to AlertsBar support or use it against the REST API to pull the full record. Show it verbatim as a reference id when the user wants to investigate a specific record further, and otherwise leave it out of the summary."New value: +"Opaque internal id of the source feed or breach inside AlertsBar, shared by every record that came from it - it identifies the feed, not the individual row. It is NOT a name: do not read a stealer family, breach name, vendor or feed out of it, and never guess what it stands for. Its only purpose is follow-up - the user can quote it to AlertsBar support or use it against the REST API to pull the full record. Show it verbatim as a reference id when the user wants to investigate a specific record further, and otherwise leave it out of the summary."

Previous value: -[
-  "integer",
-  "string"
-]New value: +"integer"

Previous value: -"Which source this record came from. stealers_* = credentials taken off a specific infostealer-infected device, so a machine is compromised, not just a password. heap_* = credentials found in an unattributed ULP (Url,Login,Password) bundle, with no linkable incident, device or date. breaches = a record from a known breach incident. *_staff = the login was an address at this domain (employee); *_users = the login belonged elsewhere but the record targets this domain's site (customer)."New value: +"Which source this record came from. stealers_* = credentials taken off a specific infostealer-infected device, so a machine is compromised, not just a password. heap_* = credentials found in an unattributed ULP (Url,Login,Password) bundle, with no linkable incident, device or date. breaches = a record from a known breach incident. *_staff = the login was an address at this domain; *_users = the login belonged elsewhere but the record targets this domain's site (customer). For public mailbox providers (gmail.com, ukr.net) *_staff means a mailbox holder, not an employee. Cookies never appear here."

Previous value: -"The URL the captured credentials were for - the specific login endpoint, not just the domain. This is the actionable field: it says which of the organisation's systems is affected."New value: +"The URL, hostname or app identifier the captured credentials were for, shown as captured and NOT normalized: it may lack a scheme, include a path, be an android:// app id, a localhost/dev address or a placeholder host. For *_users it is normally a system of the queried organisation. For *_staff it is often a THIRD-PARTY site the employee signed in to, not the organisation's own system - do not say the organisation's system was breached unless the host belongs to the queried domain."

Previous value: -"Staff logins in unattributed ULP bundles - no linkable breach, device or leak date. Credentials circulating in the wild."New value: +"Staff logins in unattributed heap of ULP bundles - no linkable breach, device or leak date. Credentials circulating in the wild."

Previous value: -"Customer logins in unattributed ULP bundles - no linkable breach, device or leak date."New value: +"Customer logins in unattributed heap of ULP bundles - no linkable breach, device or leak date."

Previous value: -"Unix seconds, and its meaning follows type. stealers_*: ESTIMATED infection date - an estimate, so always say 'around' or 'estimated'. breaches: the date the breach was PUBLISHED, which is later than when it happened - say 'published', never 'happened'. heap_*: always null, because heap records carry no incident date at all; say the date is unknown and give no number."New value: +"Unix seconds, and its meaning follows type. stealers_*: ESTIMATED infection date - an estimate, so always say 'around' or 'estimated'. breaches: the date the breach was PUBLISHED, which is later than when it happened - say 'published', never 'happened'. heap_*: always null, never render it - say the leak date is unknown."

Previous value: -"Opaque internal reference for this record inside AlertsBar. It is NOT a name: do not read a stealer family, breach name, vendor or feed out of it, and never guess what it stands for. Its only purpose is follow-up - the user can quote it to AlertsBar support or use it against the REST API to pull the full record. Show it verbatim as a reference id when the user wants to investigate a specific record further, and otherwise leave it out of the summary."New value: +"Opaque internal reference source feed or breach inside AlertsBar, shared by every record from it; quote it to identify the incident, not the individual row. Its only purpose is follow-up - the user can quote it to AlertsBar support or use it against the REST API to pull the full record. Show it verbatim as a reference id when the user wants to investigate a specific record further, and otherwise leave it out of the summary."

Previous value: -"Which source this record came from. stealers_* = credentials taken off a specific infostealer-infected device, so a machine is compromised, not just a password. heap_* = credentials found in an unattributed ULP bundle, with no linkable incident, device or date. breaches = a record from a known breach incident. *_staff = the login was an address at this domain (employee); *_users = the login belonged elsewhere but the record targets this domain's site (customer)."New value: +"Which source this record came from. stealers_* = credentials taken off a specific infostealer-infected device, so a machine is compromised, not just a password. heap_* = credentials found in an unattributed ULP (Url,Login,Password) bundle, with no linkable incident, device or date. breaches = a record from a known breach incident. *_staff = the login was an address at this domain (employee); *_users = the login belonged elsewhere but the record targets this domain's site (customer)."

Added value: +{
+  "description": "The captured login with its LOCAL PART REDACTED, e.g. ...@company.com - only the domain part is real, and no address, name or individual is identified. This is what ties the record to the queried domain: for *_staff the domain part equals the queried domain, meaning an address at this organisation was found with credentials for url; for *_users it is an outside provider (gmail.com and such), meaning an external person's credentials for this organisation's site were taken. Use it to explain WHY a record belongs to this domain. The dots are a redaction, NOT a wildcard: this is one single account, never all addresses at that domain. Full logins are not available through MCP at all - they require domain ownership verification and an API key.",
+  "type": "string"
+}

Added value: +{
+  "description": "Opaque internal reference for this record inside AlertsBar. It is NOT a name: do not read a stealer family, breach name, vendor or feed out of it, and never guess what it stands for. Its only purpose is follow-up - the user can quote it to AlertsBar support or use it against the REST API to pull the full record. Show it verbatim as a reference id when the user wants to investigate a specific record further, and otherwise leave it out of the summary.",
+  "type": [
+    "integer",
+    "string"
+  ]
+}

Previous value: -[
-  "type",
-  "url",
-  "estimated_incident_at",
-  "indexed_at"
-]New value: +[
+  "type",
+  "url",
+  "login",
+  "source",
+  "estimated_incident_at",
+  "indexed_at"
+]

Previous value: -"Domain to check, e.g. example.com."New value: +"Domain to check, e.g. example.com. A full URL is accepted and normalized."