ibnaleem COMB
Query ProxyNova COMB — the February 2021 Combination of Many Breaches dump (~3.2 billion credentials). No API key.
Returns identity:password lines. This is not a live breach index and does not name source dumps. For "where did this email leak?" use leakcheck. For password hashes use weakpass.
Canonical caller: skills/comb/scripts/lookup.sh.
Route
| Input | Action |
|---|---|
| Email, username, or plaintext password (min 4 chars) | COMB search |
| MD5 / NTLM / SHA-1 / SHA-256 hash | Stop. Use weakpass. |
| Need breach names, dates, or field categories | Stop. Use leakcheck. |
| Phone, domain, stealer origin | Stop. Use leakcheck (Pro for most of these). |
The API is a token search, not an exact match. jrubin@aol.com returns the same family of jrubin@… rows as jrubin (count may cap at 10000). After the call, keep only lines whose identity equals the requested email (case-insensitive) when the user asked for that address.
Lookup
GET https://api.proxynova.com/comb?query={query}&start=0&limit=20
skills/comb/scripts/lookup.sh "$QUERY" [start] [limit]
URL-encode {query}. Minimum 4 characters.
| Param | Default | Rules |
|---|---|---|
query |
required | Email, username, or password. Min 4 chars |
start |
0 |
Offset. Must be ≥ 0 |
limit |
20 (API default) |
Page size 0–100. 0 = count only, empty lines |
start + limit must be ≤ 100. start=90&limit=10 is valid; start=90&limit=15 is 400. You cannot page past the first 100 hits.
200:
{
"count": 795,
"lines": [
"jrubin@247callcapture.com:IUSPgL1T",
"jrubin@247callcapture.com:michelle"
]
}
count— total hits (not the page size). Generic tokens often show10000(Elasticsearch window cap), not a true totallines— this page, eachidentity:password. Identity is usually an email; case variants are separate rows- Nothing found:
"count": 0,"lines": []— still 200
count can be 795 while lines has 2 (limit=2). Always report both. Show a short sample; do not paste 100 passwords into chat.
Errors
JSON body plus HTTP status. Surface both.
| Status | Body | Meaning |
|---|---|---|
| 200 | count / lines |
Hit or empty |
| 400 | Search ?query must be at least FOUR characters long |
Query too short |
| 400 | You are limited to 100 results |
limit > 100 or start + limit > 100 |
| 400 | Something went wrong + exception_message |
Bad start (e.g. negative) |
Rate limit: about 100 requests/minute. Space bulk checks. Do not retry 400. If a 429 appears, wait and retry once.
Report
Quote API fields. Mark anything inferred. Filter to the requested identity when the query was an email.
# COMB: {query}
- Dataset: Combination of Many Breaches (2021)
- Count: {n} (API total; may be capped at 10000)
- Returned: {len(lines)} (start={start}, limit={limit})
- Exact-email matches: {n} (if filtered)
## Sample
- {identity} : {password}
Treat recovered passwords as sensitive. Put them in the report the user asked for; do not write them into logs, tickets, or world-readable files. Do not attempt logins with leaked credentials.