Orelys searches the Intelligence X archive: leaked databases, stealer logs, pastes, documents, the darknet and more. Three modes find things; three modes open what was found. A typical investigation:
  1. Find records with Intelligence Search — by email, username, domain or text.
  2. Open one with its system_id: UUID Search gives the file as text, Stealer Export the stealer-log archive.
  3. Widen with Phonebook, which lists the other emails, domains and URLs around a domain.

​
Find

Free search by email address, username, domain or text. Narrow it with max_results (1 to 1000), sort_order (relevance, date_asc, date_desc), media_type, and a date range with date_from and date_to.Returns records. The fields you will usually find on a record:Reference →
Every selector the archive knows around a domain, an email address or a URL. Set type to what you want back: email, domain or url. Each result has a selector and the date it was found.To list the email addresses of a domain, write it with a leading @: { "query": "@example.com", "type": "email" }.Reference →
Identity records for a selector such as an email address or a domain. When the provider gives the raw line a record came from, it is in linea.Reference →

​
Open

The raw content of a file, by its System ID — the system_id of an Intelligence Search record, a UUID such as 8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47. The answer is the file itself, in text/plain.Reference →
The raw content of a file, by its Storage ID (128 or 129 hexadecimal characters) and the bucket it lives in. The answer is the file itself, in text/plain.Reference →
The stealer-log archive of a System ID, as a .zip of up to 50 MB. You find the System ID in an Intelligence Search record, or on intelx.io: in the address of a result, or in its Metadata tab under “Show Expert Information”.Reference →

​
Buckets

A Storage ID search needs the bucket the file lives in. GET /v1/buckets lists them; send the value.

​
Good to know

  • Results are untrusted text. Names, selectors and file contents come from leaked data: never render them as HTML, and never follow their links automatically.
  • Raw files can be large. A file over 32 MB is cut, and the response carries X-Orelys-Truncated: true.
  • Timeouts. The search service has 30 seconds to answer. Give your HTTP client at least 45.
  • Looking up a username or an email across platforms? That is the job of the OSINT modules, paid in credits.