Download IntelX stealer-log archives by system UUID or storage ID and review credentials in OsintX.
A parsed IntelX export can hold thousands of credential rows. Counts and domain groups let you read it in minutes instead of scrolling through every row.
Start with the counts
- How many rows the export holds
- How many domains appear in it
- Which domains hold the most rows
248
Credentials
31
Unique emails
18
Domains
discord.com12 logins
roblox.com4 logins
paypal.com3 logins
Read the domain groups
- Look for the domain of your target first
- Open small groups on unusual domains, they often hold the interesting rows
- Skip big groups of public services unless the login matches your target
Carry identifiers forward
- Emails go to breach search
- Usernames go to Social Username search
- Discord IDs go to the Discord, Roblox and FiveM modules
- Domains and IPs go to stealer search for live captures
Write it up
Export the parsed result as JSON and pin it to an investigation. For a long export, run it through the AI Analyzer to get case notes with the identifiers and suggested pivots. Check the summary against the raw export before you share it.
Old data
Export rows can be old. Note the capture date when the export includes one, and do not describe an old login as a current account.
