# FortiBleed

> Check whether your company domain appears in the public FortiBleed domain dataset after verifying a company email on that domain.

Source: https://docs.vigilbase.com/tools/fortibleed

The FortiBleed Check looks up an exact company domain in the sanitized public Hudson Rock FortiBleed domain dataset provided to Vigilbase. It is a lookup in a dataset snapshot, not a scan of your Fortinet devices. Run it at [vigilbase.com/tools/fortibleed-check](https://vigilbase.com/tools/fortibleed-check).

## Why you verify a company email

A match can imply credential exposure, so results are shown only after you verify a company email from the checked domain or an allowed parent domain. To check `vpn.example.com`, verify an address at `example.com`. Personal and free mailbox providers are refused, and results are bound to the verified email and domain.

## Run a check

:::steps
1. **Enter your company domain and company email.** Use the same domain, or a parent company domain for a subdomain check.
2. **Complete the security check** and select **Send Verification Code**.
3. **Enter the 6-digit code** from the email. The result appears on the page.
:::

The result names the dataset source and its retrieval date. FortiBleed results are never shown on a saved-run page or in a link preview, so the domain you checked is not revealed by a shared link.

## What the result means

| Result | Meaning |
| --- | --- |
| **Domain appears in the FortiBleed dataset** | The domain is in the dataset. The result shows the dataset's credential count, infostealer user and employee counts, and company details where provided. Vigilbase has not confirmed the underlying credentials or a current compromise. |
| **Domain was not found in this dataset** | The domain is not in this dataset. Other exposures are not covered. |

Treat either result as one piece of evidence alongside your authentication logs, account history and endpoint telemetry. Read the retrieval date to judge how current it is.

## If your domain is listed

Ask your security owner to review Fortinet access and authentication evidence. Investigate affected accounts, possible credential reuse and signs of unauthorized access, and where exposure is confirmed, coordinate credential rotation, session review and further investigation through your incident process. The lookup itself does not reset credentials or contain an incident.

## Access from code

FortiBleed is not on the anonymous [Agent API](https://docs.vigilbase.com/tools/developers/agent-api). From the CLI it runs through Vigilbase One and needs a sign-in:

```bash
vigilbase login
vigilbase run fortibleed-check example.com
```