---
title: "Get all stealer log email aliases for an email domain"
method: GET
path: "/stealerlogsbyemaildomain/{domain}"
---

# Get all stealer log email aliases for an email domain

`GET /stealerlogsbyemaildomain/{domain}`

Available on Pro subscriptions. Searches stealer-log data by the domain portion of the email address and returns aliases mapped to the website domains where those credentials appeared. The domain must already be added to the domain search dashboard and successfully verified. The current subscription must include stealer-log access.

## Path parameters

- `domain` string, required

## Headers

- `user-agent` string, required

## Response `200`

Map of email aliases to website domains, both sorted alphabetically

- object

## Other responses

- `401` — Unauthorized — the hibp-api-key header was missing, malformed, or invalid.
- `403` — Forbidden — no user agent has been specified in the request, the domain has not been verified for this subscription, or the current subscription product does not include access to stealer logs.
- `404` — Not found — there are no stealer-log results for that email domain.
- `429` — Too many requests — the domain-based stealer-log rate limit has been exceeded. This limit is independent of the subscription RPM.
- `503` — Service unavailable — usually returned by Cloudflare if the underlying service is not available.

---

[API](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3.md) · [All operations](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/haveibeenpwned/have-i-been-pwned-api-v3/revisions/b6c35caec844/schema)