---
title: "Get all stealer log domains for an email address"
method: GET
path: "/stealerlogsbyemail/{email}"
---

# Get all stealer log domains for an email address

`GET /stealerlogsbyemail/{email}`

Available on Pro subscriptions. Searches stealer-log data by the full email address captured by an info stealer. The email address must be on a domain already added to the domain search dashboard and successfully verified. The current subscription must include stealer-log access.

## Path parameters

- `email` string, required

## Headers

- `user-agent` string, required

## Response `200`

List of website domains sorted alphabetically where this email address appeared in stealer logs

- string[]

## Other responses

- `401` — Unauthorized — the hibp-api-key header was missing, malformed, or invalid.
- `403` — Forbidden — no user agent has been specified in the request, the email domain has not been verified for this subscription, or the current subscription product does not include access to stealer logs.
- `404` — Not found — there are no stealer logs for that email address.
- `429` — Too many requests — the rate limit has been exceeded.
- `503` — Service unavailable — usually returned by Cloudflare if the underlying service is not available.

---

[API](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3.md) · [All operations](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/haveibeenpwned/have-i-been-pwned-api-v3/revisions/b6c35caec844/schema)