Snusbase API Docs

Table of Contents

1. Introduction
2. Authentication
3. API Endpoints
   • Database Statistics
   • Database Search
   • Combo Lookup
   • Hash Lookup
   • IP WHOIS Lookup
4. Example Search Queries
   • Multiple Terms and Types
   • Search Specific Tables
   • Group by Specific Column
   • Search with Wildcards
5. Code Examples
   • JavaScript
   • Python
6. Error Handling
7. Rate Limiting
8. Important Information

Introduction

Welcome to the Snusbase API documentation. This guide provides comprehensive information on how to authenticate and interact with our API endpoints.

Authentication

All API requests require authentication using an activation code. Include your activation code in the Auth header of each request:

Auth: sb[...]

Activation codes generated after September 2021 start with sb followed by 28 random characters.

API Endpoints

Database Statistics

Retrieve information about the current databases in the main search engine. This endpoint does not require authentication.

• Endpoint: https://api.snusbase.com/data/stats
• Method: GET

Request Example

GET https://api.snusbase.com/data/stats

Response Example

{
  "rows": 18006941078,
  "tables": {
    "0001_STEALERLOGS_NA_121M_MALWARE_2023": [
      "email", "username", "password", "host", "_domain"
    ],
    /* Other tables */
  },
  "features": {
    "view_more": [
      "0005_ZING_VN_51M_ENTERTAINMENT_052015",
      /* ... */
    ],
    "combo_lookup": [
      "0001_PEMIBLANC_COMBOLIST_245M_2018",
      /* ... */
    ]
  }
}

Database Search

Search the Snusbase database for leaked information.

• Endpoint: https://api.snusbase.com/data/search
• Method: POST
• Headers:
  • Content-Type: application/json
  • Auth: YOUR_API_KEY_HERE

Parameters

| Parameter | Type | Required | Description | |------------|---------------------|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------| | terms | Array of strings | Yes | Search terms. | | types | Array of strings | Yes | Types of data to search. Possible values: "email", "username", "lastip", "password", "hash", "name", "_domain". | | wildcard | Boolean | No | Enable wildcard search (true or false). | | group_by | Boolean or string | No | Group results. Defaults to "db". Set to false to disable grouping. | | tables | Array of strings | No | Limit search to specific tables. |

Request Example

POST https://api.snusbase.com/data/search
Content-Type: application/json
Auth: YOUR_API_KEY_HERE

{
  "terms": ["example@gmail.com"],
  "types": ["email"]
}

Response Example

{
  "took": 31.714,
  "size": 1233,
  "results": {
    "2123_BREACHFORUMS_BF_323K_HACKING_012026": [
      {
        "username": "avvd",
        "email": "example@gmail.com",
        "lastip": "127.0.0.9",
        "hash": "$argon2i$v=19$m=65536,t=4,p=1$NVphazc1SUg3YUVxNFV3Nw$EmshtvIzcwhG8lnDTsl0XvzCyg7h8k+Qr3tgTQihvZI",
        "salt": "Wlwirmmh",
        "uid": "331153",
        "created": "1729340505",
        "updated": "1729341708"
      }
    ],
    /* Other results.. */
  }
}

Combo Lookup

Search the combolist database for username/password combinations from large credential dumps.

• Endpoint: https://api.snusbase.com/tools/combo-lookup
• Method: POST
• Headers:
  • Content-Type: application/json
  • Auth: YOUR_API_KEY_HERE

Parameters

| Parameter | Type | Required | Description | |------------|---------------------|----------|----------------------------------------------------------------------------------------------------------------------------| | terms | Array of strings | Yes | Search terms (usernames or passwords). | | types | Array of strings | Yes | Types of data to search. Possible values: "username", "password". | | wildcard | Boolean | No | Enable wildcard search (true or false). | | group_by | Boolean or string | No | Group results. Defaults to "db". Set to false to disable grouping. |

Request Example

POST https://api.snusbase.com/tools/combo-lookup
Content-Type: application/json
Auth: YOUR_API_KEY_HERE

{
  "terms": ["example@gmail.com"],
  "types": ["username"]
}

Response Example

{
  "took": 2.905,
  "size": 1194,
  "results": {
    "0007_COLLECTION3_COMBOLIST_300M_2019": [
      {
        "username": "example@gmail.com",
        "password": "0981122847"
      },
      {
        "username": "example@gmail.com",
        "password": "123456"
      },
      /* Other results.. */
    ],
    /* Other combolists */
  }
}

Hash Lookup

Search for corresponding plaintext passwords or vice versa in the cracked password hash database.

• Endpoint: https://api.snusbase.com/tools/hash-lookup
• Method: POST
• Headers:
  • Content-Type: application/json
  • Auth: YOUR_API_KEY_HERE

Parameters

| Parameter | Type | Required | Description | |------------|---------------------|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------| | terms | Array of strings | Yes | Hashes or passwords to look up. | | types | Array of strings | Yes | Types of lookup. Possible values: "hash", "password". | | wildcard | Boolean | No | Enable wildcard search. | | group_by | Boolean or string | No | Group results. Defaults to "db". Set to false to disable grouping. |

Request Example

POST https://api.snusbase.com/tools/hash-lookup
Content-Type: application/json
Auth: YOUR_API_KEY_HERE

{
  "terms": ["482c811da5d5b4bc6d497ffa98491e38"],
  "types": ["hash"]
}

Response Example

{
  "took": 0.102,
  "size": 1,
  "results": {
    "HASHES": [
      {
        "hash": "482c811da5d5b4bc6d497ffa98491e38",
        "password": "password123"
      }
    ]
  }
}

IP WHOIS Lookup

Retrieve WHOIS information for IP addresses.

• Endpoint: https://api.snusbase.com/tools/ip-whois
• Method: POST
• Headers:
  • Content-Type: application/json
  • Auth: YOUR_API_KEY_HERE

Parameters

| Parameter | Type | Required | Description | |-----------|------------------|----------|------------------------------| | terms | Array of strings | Yes | IP addresses to look up. |

Request Example

POST https://api.snusbase.com/tools/ip-whois
Content-Type: application/json
Auth: YOUR_API_KEY_HERE

{
  "terms": ["12.34.56.78"]
}

Response Example

{
  "took": 6.4,
  "size": 1,
  "results": {
    "12.34.56.78": {
      "continent": "North America",
      "continentCode": "NA",
      "country": "United States",
      "countryCode": "US",
      "region": "OH",
      "regionName": "Ohio",
      "city": "Columbus",
      "zip": "43215",
      "lat": 39.9612,
      "lon": -82.9988,
      "timezone": "America/New_York",
      "isp": "AT&T Enterprises, LLC",
      "org": "AT&T Enterprises, LLC",
      "as": "AS7018 AT&T Enterprises, LLC",
      "asname": "ATT-INTERNET4",
      "mobile": false,
      "proxy": false,
      "hosting": false
    }
  }
}

Example Search Queries

Multiple Terms and Types

When using multiple types, each type will be applied to all terms, so you don't need to match them in order.

Request Example

POST https://api.snusbase.com/data/search
Content-Type: application/json
Auth: YOUR_API_KEY_HERE

{
  "terms": ["example1", "exa