Public Leaks OSINT: Mining Breach Data for Intelligence

Disclaimer: All information provided in this article is for educational purposes and authorized security research only. The tools and techniques discussed should only be used on systems you own or have explicit permission to test. Unauthorised information gathering may violate laws such as the Computer Fraud and Abuse Act (CFAA), GDPR, or the Investigatory Powers Act.

TL;DR

• The Problem: Breaches are no longer just for the dark web; billions of records (like the 2024 NPD leak) are circulating in public indices.
• The Solution: Treat old passwords and recovery emails as identity anchors, not just security failures.
• The Workflow: We move from risky manual dorking to safe, structured analysis using UserSearch’s Public Leaks modules (IntelX & Dehashed).
• The Outcome: You will learn to link anonymous emails to real identities, map compromised devices via Stealer Logs, and build defensible risk profiles.

2.1 Defining the Breach Lifecycle

To effectively mine breach data, you must understand its lifecycle. Data does not instantly appear in a searchable database the moment a server is hacked. It travels through a distinct economic supply chain.

In 2024 alone, we saw the National Public Data (NPD) breach expose nearly 3 billion records, effectively leaking the social security numbers of almost every American. But how did that data travel? It typically follows this path:

1. The Exfiltration: Threat actors extract the data (SQL dump, JSON export).
2. The Private Sale: The data is sold privately on exclusive dark web forums (e.g., Exploit.in or XSS) to high-tier fraudsters.
3. The Public Drop: Once the value is exhausted, the data is leaked publicly on "reputation" forums like BreachForums or Telegram channels to build street cred.
4. The Aggregation: This is where OSINT comes in. Aggregators (like IntelX, Dehashed, and Snusbase) index these massive datasets, standardizing them into a searchable format.

As an analyst, you are typically interacting with stage 4. However, you will encounter different types of data:

• Combo Lists: These are the "sludge" of the breach world. They are massive text files containing billions of email:password pairs, stripped of all context. They are useful for checking password reuse but offer little forensic value.
• Database Dumps: These are gold. A full SQL dump from a site like Ashley Madison or a niche forum contains rich metadata: registration IPs, physical addresses, private messages, and recovery emails.
• Stealer Logs: The modern threat. These are not server hacks; they are logs from malware (like RedLine, Lumma, or Raccoon Stealer) infected on personal devices. They contain browser cookies, autofill data, and system specs. Finding a target in a stealer log means you are looking at their specific infected device.

2.2 The Strategic Value of Old Passwords

Why do we care about a password from 2012? Because humans are creatures of habit. The "Password Reuse Matrix" is the concept that users rarely invent new passwords; they iterate on a core root.

Consider a target using the password Mustang1969! in a 2013 Yahoo breach. This single string tells you:

• Sentiment: They likely like Ford Mustangs or horses.
• Date Anchor: 1969 could be a birth year or a significant event.
• Pivot Point: If you search for the password hash of Mustang1969! in a database, you might find it linked to a supposedly anonymous protonmail address: [email protected].

This technique—Password Pivot—is how investigators de-anonymize threat actors. It was a primary vector in identifying the operators behind the Snowflake attacks, where credential stuffing (using old passwords to breach new accounts) allowed actors to bypass non-MFA accounts.

2.3 Manual Breach Hunting (The Hard Way)

Before using automated platforms, it is critical to understand how to hunt breaches manually. This "hard way" teaches you the syntax of leaks but comes with significant operational risks.

Google Dorking for Pastes

Hackers often dump "proof" or small lists on text hosting sites. You can locate these using search operators (Dorks).

site:pastebin.com "[email protected]"
site:ghostbin.com "password" "@gmail.com"
filetype:txt "email" "password" "target_company"

Why this is dangerous: Visiting these sites directly exposes your IP to the hosting provider and potentially to malicious ads or scripts embedded in the page. Always use a VPN and a sandboxed browser.

Have I Been Pwned (HIBP)

The industry standard for defensive checking. It allows you to enter an email and see which breaches it has appeared in.

• The Limitation: HIBP is a binary check ("Yes/No"). It does not show you the content of the breach (the password, the IP, the address) for privacy reasons. It is excellent for triage but insufficient for deep investigation.

Local Dump Analysis

Some analysts download the "Breach Compilation" (a 100GB+ text file) to their local machine and use command-line tools like grep or ripgrep to search it.

ripgrep "[email protected]" collection_1.txt

The Risk: Storing 100GB of stolen credentials on your work laptop is a massive liability. It creates compliance issues (GDPR/CCPA) and security risks (if your laptop is compromised, you become the distributor of stolen data).

2.4 The UserSearch Pivot

This is where UserSearch transforms the workflow. Instead of visiting shady paste sites or hoarding illegal dumps, you use a compliant, cloud-based engine that queries valid threat intelligence providers.

UserSearch acts as a unified console, integrating IntelX and Dehashed—two of the world's largest breach indices—into a single view (the "OneScan" system). This allows you to query billions of records without ever touching the raw data files.

The OneScan Workflow

1. Select the Module: Choose Public Leaks (OneScan) from the Search menu.
2. Configure Filters: Click the gear icon. You can toggle specific providers or adjust the "Query Type" (Email, Domain, Username, IP).
3. Execute: Run the search. The system queries both indices in parallel.
4. Triage: Results appear side-by-side. You can immediately see:
   • Source: Was it a "Collection" (generic) or a specific "Stealer Log"?
   • Context: Does the record include a physical address or phone number?
   • Timeline: Is the data from 2015 or last week?

2.4a Deep Dive: IntelX vs Dehashed

Why do we use both? Because they cover different parts of the internet. Understanding the difference is key to a successful pivot.

IntelX (Intelligence X): IntelX is an archive of the "public web" and darknet. It indexes paste sites, dark web forums, and leakage sites. It is exceptionally good at finding unstructured data—like a text file uploaded to a random server or a PDF document containing a list of employees. If a developer accidentally pushes a config file to a public repo, IntelX is likely to catch it.

Dehashed: Dehashed focuses on structured database dumps. It excels at indexing the massive SQL files from major breaches (LinkedIn, Canva, MyFitnessPal). It normalizes this data, allowing you to pivot on fields like "hashed password" or "VIN number." When you need to cross-reference a username across twenty different platforms, Dehashed provides the structured linkage.

By running Public Leaks (OneScan), you query both the unstructured chaos of IntelX and the structured tables of Dehashed simultaneously, ensuring no signal is missed.

2.5 Fully Worked Scenarios

Theory is useful, but execution is what matters. Here are three real-world investigation patterns using UserSearch.

Scenario A: The "Ghost" Executive (due diligence)

Context: You are vetting a potential C-suite hire, "Alex Mercer." His resume is spotless, but his digital footprint seems too clean. You have his personal email: [email protected].

The Investigation:

1. Initial Search: You run [email protected] in Public Leaks (OneScan).
2. The Result: It returns zero hits. This is suspicious for a 20-year career. It suggests the email is a "burner" created recently.
3. The Pivot: You search for his name in People Search and find an old university email: [email protected].
4. The Breakthrough: You run the university email in Public Leaks.
5. The SERP Result:
   Source: Adobe Breach (2013)
   Email: [email protected]
   Password Hint: "RedSox1990"
6. The Password Pivot: You take the string RedSox1990 (and variations) and search it in the Public Leaks module (setting Query Type to "Password" or "Text").
7. The Connection: The search returns a hit for a different email: [email protected], which uses the exact same password string.
8. Outcome: You now have his real personal email. A quick check of [email protected] reveals profiles on high-risk gambling forums and a history of undisclosed side businesses.

Scenario B: The Stealer Log Infection (Incident Response)

Context: Your company's SOC detects an anomaly. An employee, "Sarah," logged in from an unknown device in Russia. She claims she was hacked.

The Investigation:

1. The Query: You enter Sarah's corporate email [email protected] into Public Leaks (OneScan).
2. The Result: You see a result tagged [Source: Lumma Stealer Log] dated 3 days ago.
3. The Deep Dive: You expand the result details. Unlike a normal breach, this log includes:
   • Machine Name: "DESKTOP-55F9"
   • OS: Windows 11 Pro
   • Installed Software: "Cracked Adobe Photoshop", "Free Minecraft Launcher".
4. The Analysis: The presence of "Cracked" software confirms the infection vector. Sarah installed pirated software on her work (or BYOD) machine, which deployed the Stealer.
5. Outcome: You can now isolate the specific device (DESKTOP-55F9) and revoke all session tokens present in that log, effectively stopping the attack.

Scenario C: The Dark Web Forum Pivot

Context: You are tracking a threat actor known as "CyberViper" on Telegram who is selling stolen credit cards. You need to identify their real persona.

The Investigation:

1. Username Search: You run "CyberViper" in Public Leaks (OneScan) with Query Type set to Username.
2. The Hit: Dehashed returns a result from "RaidForums (2020)". The record shows Username: CyberViper linked to Email: [email protected] and IP: 45.33.22.11.
3. The Reverse Email: You take [email protected] and run it in Email Search (Enriched).
4. The Connection: The email is linked to a LinkedIn profile for a "Junior Python Developer" in Estonia.
5. Corroboration: You check the IP address 45.33.22.11 in the IP Threat module. It resolves to a residential ISP in Tallinn, Estonia, matching the LinkedIn location.
6. Outcome: You have successfully pivoted from a Telegram handle to a likely physical identity using historical breach data as the bridge.

2.6 Advanced Pivot Strategies

Beyond simple email lookups, there are advanced ways to use breach data to map networks.

The "Salt" Pivot

In many SQL dumps, passwords are hashed with a "Salt" (a random string). Sometimes, lazy developers or admins use the same Salt for every user, or reuse the same Salt across different websites they administer. If you find a unique Salt string in a breach record, search for that Salt. You may find every other user on that platform, or other platforms run by the same admin.

The Registration IP Map

Breach data often preserves the Registration IP. If you are tracking a harasser who uses five different email aliases, check the Registration IP for each in the breach data. If [email protected] and [email protected] both registered from 203.0.113.55 in the same week, you have a strong correlation. Use UserSearch's IP Threat module to check if that IP is a residential line (strong link) or a VPN (weak link).

Analyzing Stealer Logs: Anatomy of a Log

Stealer logs are more than just credentials; they are a snapshot of a user's digital life. When analyzing a log found via UserSearch, pay attention to these files often found in the source dump:

• Cookies.txt: Contains session tokens. If these are fresh (valid), an attacker can bypass MFA.
• Wallet.dat: Crypto wallet files. These can be analyzed to trace blockchain transactions.
• Passwords.txt: The raw list of saved browser passwords.
• Autofill.txt: Addresses, names, and credit card numbers saved in the browser.

Understanding this anatomy allows you to assess the severity of a breach. A simple credential leak is bad; a full stealer log infection is a total compromise of the digital identity.

2.7 Legal & Ethical Guardrails

Working with breach data requires strict adherence to legal and ethical standards.

• No Active Use: Never use a found password to log into an account. This is unauthorized access (hacking) and is illegal under the CFAA and similar laws globally. Your goal is intelligence, not access.
• Data Minimization: Do not download raw dumps. Use the UserSearch interface to view only the necessary snippets of data. This keeps your local environment clean of stolen property.
• Privacy Mode: For sensitive investigations (e.g., involving VIPs or internal employees), enable Privacy Mode in your Case setup. This ensures that your search history and bookmarks are not logged to the UserSearch database.

2.8 Conclusion

Breach data is the memory of the internet. It remembers every password we tried to hide and every account we forgot we created. For the OSINT analyst, it is the most potent tool for attribution. It bridges the gap between the digital alias and the human behind the keyboard.

However, the volume of data is overwhelming. Manual hunting is slow, dangerous, and incomplete. To turn billions of leaked records into actionable intelligence, you need a structured engine.

Stop guessing. Start investigating. Run structured identity OSINT with UserSearch at https://www.usersearch.com.