What this endpoint does

Retrieves all stolen credentials associated with a specific IP address or IP range belonging to a compromised machine. The IP address is the victim's public IP at the time of malware infection, not the IP of a target service. Use an exact ip for single-address lookup, or a range with comparison operators (gte, lte, gt, lt) to search across IP blocks — useful for investigating all compromised devices within a network segment. IP addresses can be found in the dump.infrastructure.ip field of records returned by the Identity: Detections endpoint. The Identity: Hostname Lookup endpoint provides the same capability using the machine's computer name instead of IP.

Response data

Returns identities grouped by subject (email or username), each containing credential records with the targeted login service (URL and domain), password hash values and complexity indicators, stolen browser cookies, the responsible malware family, and detailed compromise metadata including the victim's operating system, computer name, geolocation, and exfiltration date.

200Success

400Bad Request

401Unauthorized

403Forbidden

500Internal Server Error

defaultError