Pwned 电子邮件泄漏测试器

网络与网站, 开源情报

自由的
无需下载/安装
无需注册

Have I Been Pwned (HIBP) 会将任何电子邮件与已知互联网泄露或数据泄露数据库进行比对，以检查您的电子邮件是否可能与其他敏感个人信息一样遭到泄露。HIBP 作为一个集中式数据泄露聚合库，索引了超过 140 亿条来自公开泄露和恶意软件窃取日志的唯一记录。该平台允许用户查询电子邮件地址和电话号码是否已被泄露，以识别特定数据类别，例如密码、物理地址或 IP 历史记录。对于组织安全，它提供了一个 RESTful API，用于自动凭据检查，以及一个域搜索功能，使管理员能够在无需存储明文密码的情况下监控整个企业命名空间是否存在系统性风险。

如果你使用邮箱好几年了，你的邮箱没有发生任何泄露事件才真正令人惊讶。根据我们的测试，我们自己的邮箱也曾出现在 2 到 10 起泄露事件中。所以，核实一下总是没错的。不过，泄露事件的列表和详细信息也很有意思。

HIBP可用于保障数字供应链安全和保护专有信息。知识产权这些行业的专业人士可以利用此类服务来：

将 Pwned Passwords API 集成到工业控制系统 (ICS) 的身份验证系统中，以阻止使用已知的泄露凭据。
审计工程和研究团队的企业身份，以降低企业间谍活动和敏感研发数据或专有设计被盗的风险。
监控创新中心是否存在凭证泄露，这些泄露可能导致企业网络内部的横向流动或未经授权访问模拟环境。
通过确保第三方供应商和承包商遵守严格的凭证安全规范来维持质量保证标准，从而降低勒索软件导致生产中断的风险。

学科： 网络安全、隐私、IT管理、开源情报。

Free alternative to DeHashed, Mozilla Monitor.

Have I Been Pwned compared with DeHashed and Mozilla Monitor
Have I Been Pwned	DeHashed	Mozilla Monitor (now Mozilla Monitor)
Function and data source: Checks email addresses and phone numbers against known breaches, and offers domain search for verified domains and the Pwned Passwords service.	Function and data source: A personal asset search engine over data posted on the clear and deep web, with lookups for usernames, emails and IP addresses. It returns the exposed data itself, as well as notifying about breaches.	Function and data source: The service was renamed Mozilla Monitor. It scans for exposure of an email address, and Mozilla states that its breach data comes from Have I Been Pwned.
API and automation: Breached account, paste, domain and stealer log queries need a 32-character API key sent in the hibp-api-key header. Pwned Passwords needs no key and uses k-anonymity: only the first 5 characters of a SHA-1 hash are sent.	API and automation: An API is offered for programmatic breach-data queries. Its pricing page does not state whether API access is part of a plan.
成本模型： API tiers are Core, Pro and High RPM, and stealer log queries require Pro or higher. Prices are on the pricing page, which could not be read here.	成本模型： Paid plans are listed for 7 days, one month and one year, with unlimited asset searches in each plan.	成本模型： Described as free. A public breach search works without an account, while future alerts and the detailed report need a Mozilla account.
Licence and verification: The breach and paste APIs are under CC BY 4.0, which requires crediting Have I Been Pwned with a link. Domain search requires proving control by a DNS TXT record or an approval email to one of five aliases (admin, hostmaster, info, security, webmaster).		Licence and verification: Users can opt an email out of the underlying Have I Been Pwned database through its opt-out page.

涵盖的主题： 电子邮件泄漏测试、数据泄露、凭证泄露、敏感个人信息、HIBP、集中式存储库、RESTful API、凭证检查、域名搜索、数字供应链、商业间谍、专有知识产权、Pwned Passwords API、工业控制系统、创新中心、凭证卫生、质量保证和勒索软件。

Privacy: we have no feedback of potential problem with this tool and author. But like many online services, you are here providing them with your own data. Depending of the criticity of your data, this is your responsibility to assess author's reputation and potential misusage, and to check and accept their terms and conditions, or not.