Email address → HaveIBeenPwned breach list. Domain → corpus signals. Real lookups, no fabricated data.