Revealer.US is an OSINT search platform. Type an email, a username, a phone number, or an IP. It comes back with the public places that identifier already sits: breach data, stealer logs, public records, live profiles. One report. A source on every line, or the line does not ship.
We are not a data broker. We do not own this data, and we do not sell it. Every result is fetched live, in real time, when you search. We do not own that data, and we do not retain your search data.
- platforms
- 800+platformsqueried when you search, not from a scrape we sat on
- source classes
- 04source classesbreach dumps, stealer logs, public records, live profiles
- automatic search history
- 00automatic search historyyou choose what to save to your account
- report
- 01reportevery match cites the source it came from
We got tired of doing this in forty browser tabs.
Revealer.US is a small remote team of OSINT people and security engineers. For years I ran exposure work the long way: one tab per breach checker, one tab per social platform, a spreadsheet to glue the mess together, a client on the clock. The data was already public. Seeing it in one place, fast enough to act, was the part nobody had shipped.
So I stopped doing it by hand. One query reaches 800+ platforms and every breach source we have connected, then comes back as a single report with each match tied to its origin. That last part is the work most OSINT tools quietly dump back in your lap.
We did not create this data. We cannot un-leak it. I will not market a delete button that does not exist. What we can do is show you the row and the source, so you can rotate the password, close the account, or open the ticket.
Questions, a complaint, a corpus we should add? Contact us · We're hiring
Four source classes. I'll name them.
800+ is a count, not a slogan: platforms we can resolve a live profile on, plus the breach corpora, stealer-log collections, and public-record sets we can actually query. The search hits those sources when you press the button. We do not host a resale copy of the underlying data. If someone is selling you that, they are a broker. We are not.
- I
Publicly disclosed breach corpora
Credential dumps that already hit the open internet: published, leaked, or traded. We index which identifiers show up in which corpus, and we add a set once it is public. We did not steal this. We do not sell it.
Look up a breach - II
Infostealer collections
Logs from malware that emptied saved passwords, cookies, and autofill off an infected machine. Ugliest pile we touch. Treat it as exposure evidence: proof something left a device, so the owner can rotate it.
Search stealer logs - III
Public records
Registries and filings anyone can request. Names, addresses, phone numbers already on the public record. That is the whole job. We do not invent a person out of a filing.
- IV
Live public profiles
Social, forum, and web profiles on 800+ platforms. We hit them when you press search. No stored mirror, so the page you get is the page that is public today, not last quarter.
Check a username
Live, real-time results. No search history.
Every search runs live, in real time, at the moment you press the button, against public sources and endpoints. What comes back streams to your screen with a source on every line. We do not own any of that data, and we do not retain your search data.
Nothing you search for is kept. What you choose to save to your own account stays yours until you delete it.
More detail is in our Privacy Policy.
Query, normalize, correlate, report.
- 01
Query
One identifier. Every connected source. Same request: breach dumps, stealer logs, public records, live profiles.
- 02
Normalize
A forum, a county record, and a social profile do not speak the same language. We strip duplicates and force one shape.
- 03
Correlate
Same handle on three sites. Same password in two dumps. A phone that tags along. Those links are the part a spreadsheet never quite catches.
- 04
Report
You get the hits, the source for each one, and a confidence score. Cannot cite it? It does not print.
Why I stopped doing the second pass by hand
AI Deep Search takes a single email, username, or phone number and follows the trail for you: it finds reused handles and linked accounts across 700+ platforms, matches them against breach and stealer-log records, and returns one report with every source cited and a confidence score for each match.
A flat lookup dies at the first match. This one pulls a username out of an old dump and walks it across the next few hundred platforms. That is how you find the account someone forgot they made.
Revealer.US is not a consumer reporting agency.
We are not a consumer reporting agency as defined by the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. Information returned by Revealer.US may not be used to decide eligibility for credit, insurance, employment, housing, or tenant screening, or for any other purpose the FCRA covers. If a decision about a person's money, job, or home hangs on it, this is the wrong tool, and using it that way violates our terms.
Use it for
- Auditing your own exposure
- Assessing exposure for an organization you are authorized to act for
- Security research and red-team reconnaissance
- Incident response and threat intelligence
- Fraud investigation
Never for
- Credit, insurance, or employment decisions
- Housing or tenant screening
- Stalking, harassment, doxxing, or intimidation
- Re-identifying or reselling what we surface
- Anything else the FCRA regulates
The full list lives in our Acceptable Use Policy and Terms of Service. When you are unsure, assume you need the account holder's authorization.
We keep billing. We drop the search.
Your searches
We do not keep the searches you run, or the results they return, unless you choose to save something to your account. Account and billing records exist because you cannot run a paid service without them. Your query text is not in that set. What we log, and for how long, is written out in the Privacy Policy.
Your record
If your information shows up in a result and you want it off our index, opt out. Be clear about the limit: we query connected sources at request time, we do not host the data, so an opt-out suppresses the record on our side. It does not delete the original. No honest service can claim otherwise.
Who I had in mind.
- Researchers
- OSINT people, pentesters, threat-intel analysts. You already know how to do this with twenty tabs. This is that workflow, with the merge step finished.
- Security teams
- Engineers watching a domain, checking a vendor, or confirming a dump is actually about you. CISOs too, if they still run their own queries.
- Individuals
- Anyone who would rather hear it from a search box than from whoever bought the dump.
Start with
your own email.
Make a free account and throw one search at it. Empty result: good day. Hits: you know which password to rotate first, instead of finding out from a stranger.
Revealer.US · About · Last reviewed 25 August 2026