CheckLeaked.cc — Deep Search, AI Investigation & OSINT Suite

One identifier in. Every breach engine, the stealer-log corpus, the linked identities, and an AI-written intelligence dossier out. LeakCheck · Have I Been Pwned · Snusbase · Dehashed · LeakRadar stealer logs · dark web · WHOIS · GHunt · IP intelligence · hash cracking — plus a WormGPT investigation agent that searches the open web and runs the tools itself.

Run deep_search on one email and the actor fans it out to five breach engines at once, follows the other e-mails / usernames / phones those hits surface, unlocks and parses the stealer-log credentials, then hands everything to the CheckLeaked AI layer: a structured dossier with a 0–100 risk score, consolidated identity, credential statistics, password analysis, cross-engine correlations, concrete attack scenarios and per-account recommendations — as a dataset row, and optionally as an A4 PDF. Add the WormGPT web investigation and you get a second, free-form Markdown dossier grounded on the same findings, with its web sources.

This is the kind of workup an OSINT analyst bills hours for. Billed per identifier and per record, only when something came back.

---

What you actually get per identifier (deep_search)

Stage	What runs	What lands in the dataset
Engines (parallel)	LeakCheck + HIBP (one call), Snusbase with load-all, Dehashed (paginated), LeakRadar raw stealer-log blocks (cursor-paginated)	one row per hit, sub = engine
Pivots (optional)	up to pivotCap linked identities the rows surfaced — other e-mails, reused handles, phones — each a full search across the same engines, up to five hops deep (a handle found at hop 4 is searched at hop 5)	sub: pivot + the hop's own rows tagged hop: 1..5, seed
Credential extract (optional)	unlock the matched stealer-log blocks and parse the login records	sub: raw_credential (url / username / password, hash-flagged, source file)
OSINT enrichment (default on, Pro for GHunt)	first-party lookups over the identities found — GHunt Google-account profile (avatar, Local Guide standing, services) per e-mail, IP geolocation per IP — fed to the dossier as grounded facts; the avatar is embedded in the PDF	sub: enrichment — google[], ip[]
AI dossier (default on, Pro)	/deep_report over every row of every hop plus the enrichment	sub: report — risk_score, risk_level, confidence, executive_summary, full report object, pdfUrl when reportPdf
Web investigation (optional, Pro)	WormGPT agent grounded on the findings: web search + fetch, all leak/OSINT tools, pivots until dry	sub: investigation — markdown, sources[], markdownUrl
Summary	always	sub: summary — per-engine counts, pivots, credentials, report / investigation status, risk, errors

The dossier the AI writes (report):

{
  "executive_summary": "…",
  "risk": { "score": 86, "level": "critical", "rationale": "…" },
  "identity": { "emails": [], "usernames": [], "names": [], "phones": [], "addresses": [], "ip_addresses": [] },
  "credentials": { "total_passwords": 9, "plaintext": 6, "hashed": 3, "cracked": 2, "reused_passwords": ["…"], "weak_passwords": ["…"], "notes": "…" },
  "password_analysis": "…",
  "exposed_data_categories": ["…"],
  "breaches": [{ "name": "Canva", "note": "…" }],
  "correlations": ["…"],
  "attack_scenarios": ["…"],
  "recommendations": ["…"],
  "confidence": "high",
  "identity_graph": [{ "value": "…", "kind": "email", "sources": ["dehashed", "leakcheck"], "count": 4 }],
  "password_stats": { "…": "…" }
}

Identity lists, credential counts, identity_graph and password_stats are measured from the records server-side; the model only writes the prose. Hashes among the findings are cracked first (bounded, cache-first) so recovered plaintext feeds the reuse / weakness analysis.

Typical wall-clock: 5–15 s for the engines, +40–90 s for the AI dossier, +1–3 min for a web investigation.

---

Modes

Mode	Upstream	Purpose
deep_search ★	five engines + /deep_report (+ /worm_report)	Flagship. Everything above, per identifier.
investigate	POST /worm_report	WormGPT web investigation alone, on the bare term. The agent gathers on its own.
osint_report	fan-out	The classic dossier: LeakCheck+HIBP, Snusbase, Dehashed, crack hash, IP, GHunt; WHOIS + LeakRadar exposure for domains; heuristic risk score.
dehashed	POST /dehashed	Paginated Dehashed lookups, plaintext + hashed passwords.
experimental	POST /experimental	Snusbase-backed index. loadAll=true expands truncated rows.
leak_check	GET /leak_check	LeakCheck hits with HIBP hits merged in (rows flagged hibp / leakcheck).
crack_hash	POST /crack_hash	Reverse MD5 / SHA / NTLM hashes against rainbow tables.
ip_lookup	GET /ip	City-level geo + ASN + WHOIS + threat flags.
ghunt	GET /ghunt	Google / Gmail OSINT — names, photos, Maps reviews, services.
domain_whois	GET /domain-whois	Registrar, created / expires / updated, name servers, contacts, status.
hibp	POST /hibp/account-full	The full Have I Been Pwned breach list for an email, one row per breach (data classes, pwn count, verification flags).
leakradar_email	POST /leakradar/search/email	Stealer-log credential leaks for an email / username with the site they were captured on (paginated).
leakradar_raw	POST /leakradar/search/raw (+ /lines)	Free-text search over raw stealer-log blocks; rawExtract unlocks the hits and parses the credentials.
leakradar_domain	GET /leakradar/domain/report	Composite exposure report for a domain: employees / customers / third parties, subdomains, URLs. One credit.
dark_web	POST /leakradar/dark-web/search	Indexed dark-web forum / market posts mentioning the term (paginated).
pwned_password	POST /hibp/password-check	k-anonymity pwned-password check. Free, no key. The password is hashed before it leaves.
breach_info	GET /breaches/{name}	One breach's registry record. Free, no key.

★ = the headline mode. Use it unless you specifically need one engine.

Auto-detect rules (deep_search, investigate, leak_check, osint_report)

Entry shape	Detected type
foo@bar.com	email
1.2.3.4 / 2001:db8::1	ip_address
32 / 40 / 64 hex chars	hash
Digits only, 7–15 chars, optional +	phone
acme.io, mail.corp.example.co.uk	domain
Short alnum token	username
Everything else	keyword

Allowed type values per single-engine mode

dehashed      : email, username, ip_address, name, address, phone, vin, free
experimental  : email, username, mass, password, name, hash, lastip
leak_check    : auto, email, username, keyword, domain, phone, hash, password,
                origin, phash (+ legacy: mass, login, pass_email, domain_email, pass_login)
leakradar_email : (email or username; `type: username` forces the username reading)
pwned_password  : (40-hex → SHA-1; `type: ntlm` + 32-hex → NTLM; else plaintext)

---

Quick start

{
    "apiKey": "YOUR-CHECKLEAKED-BOT-KEY",
    "mode": "deep_search",
    "queries": [
        { "entry": "john.doe@gmail.com" },
        { "entry": "johnny_b", "type": "username" },
        { "entry": "+15551234567" }
    ],
    "pivotCap": 3,
    "rawExtract": true,
    "reportPdf": true
}

That single run, per identifier:

• runs LeakCheck + HIBP, Snusbase (load-all), Dehashed (up to maxPages) and the LeakRadar stealer-log corpus in parallel,
• follows the three strongest linked identities (e-mail > username > phone, ranked by how many rows carried them), each as a full search,
• unlocks up to 10 matched stealer-log blocks and emits the parsed credentials,
• generates the AI dossier over every row of every hop and typesets it as PDF (link in the report row, file in the key-value store),
• writes a summary row with per-engine counts, pivots followed and the risk.

One-shot (Zapier / Make / webhook style)

{ "apiKey": "…", "mode": "deep_search", "singleEntry": "ceo@acme.io", "webInvestigation": true }

Web investigation only

{ "apiKey": "…", "mode": "investigate", "queries": [{ "entry": "Eduardo Airaudo", "type": "name" }] }

Runs one identifier at a time (the agent allows one investigation per account at a time) and stores each dossier as INVESTIGATION_<n>_<term>.md.

---

Pricing

The actor uses Apify's Pay-Per-Event billing. You only pay for events that actually return value. Failed upstream calls, 401s, cooldown refusals and empty responses are free.

Per-event prices

Event	Apify charge	What triggers it
deep-search-dossier	$0.30	One deep_search identifier completed (summary row), whatever the engines found.
ai-report	$0.60	The AI intelligence dossier was generated for an identifier.
web-investigation	$0.90	A WormGPT web investigation completed (investigate mode or deep_search + webInvestigation).
leakcheck-record	$0.02	One LeakCheck breach record.
hibp-record	$0.02	One Have I Been Pwned breach record (in deep_search or hibp mode).
experimental-record	$0.04	One Snusbase / experimental-index breach record.
dehashed-record	$0.05	One Dehashed breach record (email/password/hash/PII fields).
leakradar-record	$0.04	One LeakRadar credential leak or raw stealer-log block.
raw-credential	$0.06	One credential record parsed out of an unlocked stealer-log block.
crack-hash-plaintext	$0.10	A hash was successfully reversed to plaintext.
ip-lookup-record	$0.01	Geo + ASN + WHOIS returned for one IP.
whois-record	$0.03	A WHOIS record returned for a domain.
domain-report	$0.25	A LeakRadar domain exposure report / summary.
dark-web-post	$0.03	One dark-web post.
osint-dossier	$0.25	One merged osint_report row with breach_count, risk_score, summary.
gmail-profile	$0.30	A Gmail identity surface was recovered inside osint_report.
ghunt-profile	$0.35	Standalone GHunt Gmail profile (mode=ghunt).

pwned_password and breach_info are free.

Events are only counted for successful responses. 401, 429, timeout, *_throttled / *_busy cooldown refusals, empty response → no charge. Pivot hops bill exactly like the seed search (per record); a linked identity that returns nothing costs nothing.

Typical Deep Search cost

Scenario (one deep_search identifier)	Records	AI dossier	Billed events	You pay
Email, heavy breach history	25	✅	dossier + report + 25 records (~$0.04 avg)	≈ $1.90
Email, light breach history	4	✅	dossier + report + 4 records	≈ $1.06
Email + 3 pivots + stealer-log extract	60 + 8 creds	✅	dossier + report + 60 records + 8 creds	≈ $3.78
Username, nothing found	0	skipped	dossier only	$0.30
Email + web investigation	10	✅ + WormGPT	dossier + report + investigation + 10 records	≈ $2.20

What your payment covers

• Upstream data subscriptions — CheckLeaked.cc Pro (required for the AI layer, plaintext passwords, load-all, GHunt), Snusbase, LeakCheck.io, LeakRadar, HIBP. These alone cost the operator hundreds per month per key.
• AI compute — every dossier is a long-context generation over hundreds of records; every investigation is an agent loop with live web search and tool calls.
• Rainbow-table compute — crack_hash and the dossier's hash-cracking step.
• Apify platform compute — container startup, memory, bandwidth.
• Engineering + maintenance — schema drift across six upstreams, new sources, new engines.

Why not self-host?

You can — CheckLeaked.cc publishes a REST API. You would need the Pro subscription, a LeakCheck.io key with a whitelisted static IP, the pivot / extract / report orchestration, the serialisation the AI endpoints demand (one call per account, 15 s cooldown) and the retry + pagination + masking code. This actor bundles all of it, billed only when a query actually returns intelligence.

---

Input reference

Field	Type	Default	Purpose
apiKey	secret string	—	CheckLeaked.cc bot key. Required except pwned_password / breach_info.
leakCheckKey	secret string	—	Optional LeakCheck.io key. Without it the account's stored key, else the system key, is used.
mode	enum	deep_search	Which tool to run (table above).
queries	[{entry, type?}]	[]	One row per lookup; type auto-detects when omitted (see rules).
singleEntry / singleType	string / string	—	Shortcut for one-shot runs.
engines	string[]	all five	deep_search: which of leakcheck, hibp, experimental, dehashed, raw to run.
pivotCap	int 0–25	0	deep_search: linked identities to follow (each a full billed search, up to 5 hops deep).
rawExtract	bool	false	Unlock matched stealer-log blocks and emit parsed credentials (deep_search, leakradar_raw).
rawMaxHits	int	10	Blocks to unlock per query when rawExtract.
aiReport	bool	true	deep_search: generate the AI dossier (Pro). Skipped when nothing was found.
enrichment	bool	true	deep_search: run GHunt (Google account + avatar) and IP-geolocation lookups over the identities found and feed them to the dossier. Each is billed (Pro for GHunt).
reportPdf	bool	false	deep_search: also store the dossier as PDF in the key-value store.
webInvestigation	bool	false	deep_search: also run the WormGPT web investigation, grounded on the findings (Pro).
startPage	int	1	First page for dehashed mode.
maxPages	int	5	Max pages per query for the paginated engines. Stops early on an empty / last page.
pageSize	int	50	Items per page for LeakRadar / dark web (max 50 / 100).
loadAll	bool	false	experimental / osint_report: ?loadAll=true. deep_search always loads all.
includeUnverified	bool	true	hibp: include unverified breaches.
maskPasswords	bool	false	Redact every credential field, the dossier's password lists and the password half of login:password lines.
includeRawResponse	bool	false	Keep raw field with upstream JSON.
maxConcurrency	int	3	Parallel queries. The AI steps always take turns 15 s apart; investigate runs one at a time.
delayMs	int	0	Sleep after each request per worker.
maxRetries	int	4	Retries on 429 / 5xx / network errors (search engines only).
requestTimeoutSecs	int	180	Per-request timeout for the engines (AI calls have their own ~3 min budgets).
proxyConfiguration	Apify proxy	off	Optional outbound proxy.
stopOnError	bool	false	Abort on first hard error. Otherwise errors become dataset rows.

---

Output

Every hit, dossier, investigation and run-level summary is pushed to the default dataset. Dataset views: Overview, Deep Search AI dossiers, AI web investigations, Deep Search summaries, Extracted credentials, OSINT dossiers, Breach records, IP intelligence, Errors.

The key-value store holds RUN_STATS, every DEEP_REPORT_<n>_<term>.pdf (when reportPdf) and every INVESTIGATION_<n>_<term>.md; rows link their own file via pdfUrl / markdownUrl.

Row anatomy (deep_search)

Every row carries mode: "deep_search", sub, entry (the searched term — for pivot rows, the linked identity), type, hop (0 = seed, 1–2 = pivot), seed (the identifier the run belongs to) and scrapedAt.

{ "mode": "deep_search", "sub": "dehashed", "entry": "other@example.com", "type": "email", "hop": 1, "seed": "john.doe@gmail.com",
  "database_name": "Canva", "email": "other@example.com", "username": "johnd", "password": "hunter2", "hashed_password": "$2y$10$…" }

{ "mode": "deep_search", "sub": "pivot", "entry": "johnny_b", "type": "username", "hop": 1, "seed": "john.doe@gmail.com",
  "via": "leakcheck.username", "from": "john.doe@gmail.com", "seen": 3, "records": 12, "raw_credentials": 0 }

{ "mode": "deep_search", "sub": "report", "entry": "john.doe@gmail.com", "risk_score": 86, "risk_level": "critical", "confidence": "high",
  "executive_summary": "…", "report": { "…": "…" }, "meta": { "engines": ["leakcheck", "hibp", "experimental", "dehashed", "raw"], "total_records": 41, "pivots": [ "…" ] },
  "pdfUrl": "https://api.apify.com/v2/key-value-stores/…/records/DEEP_REPORT_1_john.doe-gmail.com.pdf" }

{ "mode": "deep_search", "sub": "summary", "entry": "john.doe@gmail.com", "total_records": 41,
  "engines": { "leakcheck": 6, "hibp": 9, "experimental": 8, "dehashed": 14, "raw": 4 },
  "pivot_count": 2, "raw_credentials": 3, "risk_score": 86, "risk_level": "critical",
  "report_status": "ok", "investigation_status": "skipped", "errors": [] }

A failed AI step never aborts the identifier: the report / investigation row carries found: 0, a stable error code (report_pro_required, worm_quota, …) and a human error_message; the summary shows report_status: "error:<code>".

osint_report risk score formula

score  =  min(breach_count, 50) * 2        // up to 100
       +  min(breach_sources, 20) * 2      // up to 40
       +  40  if cracked_password is truthy
       +  5   if gmail_profile present
       clamped to [0, 100]

risk_level: 0=none · 1-24=low · 25-49=medium · 50-74=high · 75-100=critical

The Deep Search dossier's risk_score is the AI's, grounded on the measured credential statistics; the formula above only applies to osint_report.

---

Integrations

• Apify Scheduler — weekly VIP breach monitoring, daily employee audits.
• Webhooks — fire a POST when a summary row has risk_level in ("high", "critical").
• Zapier / Make / n8n — drop a singleEntry into the actor, receive the dossier row in your automation.
• Slack / Teams / Discord — push executive_summary on high risk; attach the PDF from pdfUrl.
• Google Sheets / Airtable — stream the dataset via Apify's native connectors.
• BI / SIEM — pull the dataset as JSON / CSV; stable keys map cleanly to Splunk, Sentinel, Datadog, or a data warehouse.

---

Recipes

Weekly executive exposure report (PDF to the inbox)

{
  "mode": "deep_search",
  "queries": [{ "entry": "ceo@acme.io" }, { "entry": "cfo@acme.io" }],
  "pivotCap": 3,
  "rawExtract": true,
  "reportPdf": true,
  "maskPasswords": true
}

Schedule weekly; forward pdfUrl from the report rows.

Full workup of one person (search + web investigation)

{
  "mode": "deep_search",
  "singleEntry": "john.doe@gmail.com",
  "pivotCap": 5,
  "rawExtract": true,
  "webInvestigation": true
}

Domain exposure audit

{
  "mode": "osint_report",
  "queries": [{ "entry": "acme.io" }]
}

WHOIS + LeakRadar exposure summary + LeakCheck (domain) + every Dehashed address at the domain + Snusbase mass search, in one dossier. For the composite LeakRadar report alone use mode: "leakradar_domain".

Stealer-log credential hunt for a brand

{
  "mode": "leakradar_raw",
  "queries": [{ "entry": "vpn.acme.io" }],
  "rawExtract": true,
  "rawMaxHits": 25,
  "maxPages": 3
}

Bulk MD5 / SHA hash cracking

{
  "mode": "crack_hash",
  "queries": [{ "entry": "5d41402abc4b2a76b9719d911017c592" }, { "entry": "098f6bcd4621d373cade4e832627b4f6" }],
  "maxConcurrency": 10
}

Password policy audit (free)

{
  "mode": "pwned_password",
  "queries": [{ "entry": "P@ssw0rd" }, { "entry": "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8" }]
}

The dataset never contains the plaintext — only a masked length and the pwned count.

---

Requirements & limits

• A CheckLeaked.cc bot key (checkleaked.cc/botLinks). Deep Search's AI dossier and the web investigation need Pro; Snusbase load-all, GHunt and LeakRadar need Plus or Pro.
• The AI endpoints allow one call per account at a time and a 15 s cooldown; the actor serialises them and retries cooldown refusals for you. A web investigation takes up to ~3 minutes and spends one unit of the account's WormGPT daily quota (Pro: 250 / day).
• Bringing your own LeakCheck.io key? Whitelist gateway IP 192.126.161.211 in your LeakCheck.io dashboard.
• Use maskPasswords: true before sharing a run with anyone who should not see plaintext credentials — it also redacts the dossier's password lists.

Legal

This actor queries breach-intelligence and OSINT services. Use it only on identifiers you are authorised to investigate (your own organisation, your customers with consent, lawful investigations). You are responsible for complying with the laws that apply to you and with CheckLeaked.cc's terms.