Intelligence X

We just added a new "Export Stealer Log" feature to our Identity Portal! 👏🏻 ➡️ https://blog.intelx.io/2026/02/08/export-stealer-log/

Shame on us! We haven't updated our 3rd party OSINT tools section in years. We updated it, changelog here: ➡️ https://intelx.io/tools?tab=changelog

We just added a new Tree View endpoint to our API: https://help.intelx.io/api/search/#filetreeview

We have added a new category "DNS". It indexes DNS records data such as raw TXT records for domains. It stores already more than 200 million records. ➡️ https://blog.intelx.io/2025/01/12/new-category-dns/

💥 We added a powerful new feature to the Identity Portal: Reverse Lookup You can now search for a domain or URL and get all leaked accounts for a particular service. ➡️ Read more at https://blog.intelx.io/2025/01/03/new-identity-portal-version-%f0%9f%92%a5/

This year we have been busy becoming an SSD-only shop. We will publish soon a blogpost about that journey. We just bought a lot of 16 TB SSDs, some for 2000 EUR a piece. We tested Kioxia SSDs, but they are not as good as the Samsung and UltraStar ones.

We added a new date filter to the Identity Portal. The filters have been improved. More updates are scheduled for January 2025. We are currently working on a reverse search related to Stealer logs.

This is a bit of a wild 🪿 goose chase. Best guess: The vulnerability was around the IPv6 Jumbo Payload parsing. See https://www.rfc-editor.org/rfc/rfc2675.html

What we know: ✅ Code has changed at multiple places in Ipv6pProcessOptions ✅ Looking for integer underflow, thanks to MS disclosure [1] ✅ We have RE'd code versions of patched/unpatched ✅ ChatGPT isn't reliable analyzing it (lol) [1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063

Windows Server 2019, tcpip!Ipv6pProcessOptions unpatched (build 6054) vs patched (build 6189):

CVE-2024-38063 Windows TCP/IP Remote Code Execution Vulnerability #reverseengineering #ipv6 #cybersecurity Time to look into this once in 10 years vulnerability!

We are adding support for 18 TLDs, increasing our support to 574 TLDs: - ad - bs - cv - cw - gf - gn - gw - gy - hospital - ht - iq - krd - mr - mw - om - study - tl - tt It will take some time for new (and old) data to be searchable under these added TLDs.

In the last 3 weeks newly added items in the "Stealer Logs" category were not searchable. They are being indexed now and will be searchable by end of the day. If you rely on alerts we always recommend to manually check for relevant data every here and then (at least monthly) due to back-dating of data.

We have corrected the name of the bucket "Russia" to "Ukraine". It contains websites from the TLDs UA, KZ and RU. We started crawling those in 2019. Intelligence X stands 100% behind Ukraine. 🇺🇦

Major usability update in our Export Leaked Accounts section: 🔹 CSV results can be now downloaded at anytime during the search. 💾 🔹 Live count of records shown This is useful in investigation cases that involve large datasets and many search results.

Tomorrow we will add a new tab to our Identity Portal "API status". It will list the daily credits available in the Leaks API, which strictly enforces the license assigned to the API key moving forward.

We are currently handling an IPv4 upstream issue. This affects our Leaks API users (Identity Portal product). IPv6 connectivity is not affected. We expect this issue to be fixed later today. Edit: The issue has been resolved.

We just pushed another update of the Identity Portal (version 8.1) that includes new algorithms to detect leaked accounts in multiline formats. 🔍 This is especially useful for the 'Bot Logs' category which stores records in multiple lines.

We just updated our Leaks API (used by the Identity Portal) to detect another format of leaked accounts. The Export Leaked Accounts function will provide more results.