3 ms·

Like this? https://haveibeenpwned.com/DomainSearch https://haveibeenpwned.com/DomainSearch

• kozhevnikov 9y ago
  Thanks!
  • nailer 9y ago
    Troy: you might want to use the standard emails (eg, admin@ rather than dns-admin@) for domain ownership - I'd worry that dns-admin@ might be available to users at some domains. Also maybe apply for a .well-known to HIBP file uploads? (It's Mike from CertSimple here BTW)
    • Trellmor 9y ago
      dns-admin@ is probably from the whois record of the domain you checked. The predefined list is only the last 4 addresses that are shown: security@, hostmaster@, postmaster@ and webmaster@.
      • nailer 9y ago
        Nope, the domain's whois doesn't use dns-admin. From the Baseline Requirements for domin control: > 3.2.2.4.4 Constructed Email to Domain Contact > i) sending an email to one or more addresses created by using 'admin', 'administrator', 'webmaster', 'hostmaster', or 'postmaster' as the local part
• tialaramex 9y ago
  So I just tried this, it's a very different proposition than normal HIBP, and much more useful to people like me who don't just have a single address and give that out everywhere. HIBP reports that zero of my addresses have been pwned. Which is weird because those addresses include several that have been pwned in well known cases, and several more where there's no public "We had a data breach" type report but it's clear that somebody did in fact lose all my data. That's pretty disappointing, it suggests HIBP doesn't have very much of the breach data that really matters, and so many unsophisticated users who get to the site are probably misled.
  • celticninja 9y ago
    Did you try some of those emails in the standard HIBP? There is a difference between a site being hacked and your details posted publicly and a company you signed up with selling your information. The former is on HIBP the latter is not.l