---
title: "Get all stealer log email addresses for a website domain"
method: GET
path: "/stealerlogsbywebsitedomain/{domain}"
---

# Get all stealer log email addresses for a website domain

`GET /stealerlogsbywebsitedomain/{domain}`

Available on Pro subscriptions. Searches stealer-log data by the website domain victims were authenticating to when their credentials were captured. The domain must already be added to the domain search dashboard and successfully verified. The current subscription must include stealer-log access.

## Path parameters

- `domain` string, required

## Headers

- `user-agent` string, required

## Response `200`

List of email addresses sorted alphabetically

- string[]

## Other responses

- `401` — Unauthorized — the hibp-api-key header was missing, malformed, or invalid.
- `403` — Forbidden — no user agent has been specified in the request, the domain has not been verified for this subscription, or the current subscription product does not include access to stealer logs.
- `404` — Not found — there are no email addresses in stealer logs for that website domain.
- `429` — Too many requests — the domain-based stealer-log rate limit has been exceeded. This limit is independent of the subscription RPM.
- `503` — Service unavailable — usually returned by Cloudflare if the underlying service is not available.

---

[API](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3.md) · [All operations](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/haveibeenpwned/have-i-been-pwned-api-v3/revisions/b6c35caec844/schema)