Upload leads · classify via SPF/PTR/HTTP · filter by rules · export with per-company caps · webhook on completion
Passive, password-free rescue of Office 365 / Exchange Online mailboxes that MX/SPF/PTR/HTTP all miss — e.g. tenants fronted by Proofpoint / Mimecast / Barracuda, or federated to Okta / ADFS / Duo. Runs on the unmatched residue after HTTP (P3) and before Region (P4). Tier C (the sign-in page) leads and Tier B (GetCredentialType) backs it up; the old Tier A getuserrealm lookup was removed because it is domain-scoped and cannot tell a real mailbox from a parked Entra domain. Rescued leads land in a distinct other-* namespace: Managed → other-office; federated → other-okta / other-adfs / other-duo / other-idp / other-godaddy; a consumer account → other-personal.
GetCredentialType — an unauthenticated, username-only lookup. No password is ever sent. Answers when Tier C reaches no verdict, which under NATS is every lead at first pass, since the browser replies by webhook.
Per-request cap for the GetCredentialType probe against login.microsoftonline.com.
The FIRST tier: types the email at the O365 login page and reads what comes back (still password-free) — the same surface a person sees, so a branded password prompt or 'username may be incorrect' is ground truth. Dispatched over NATS when wired, else a synchronous call to the sidecar. Tier B (GetCredentialType) answers when this reaches no verdict.
Cap for one login-page probe (the sync-fallback path).
The main throttle, and it adapts on its own: O365 and SERP/LinkedIn browser jobs share one queue drained by one sidecar, so when this many jobs are already waiting, Tier C stops adding and lets firmographics through. A sidecar that is keeping up drains below the line and dispatching resumes. Paused leads fall through to Tier B and their domain is retried next run — nothing is dropped. 0 = don't throttle on queue depth.
Backstop for the paths with no queue reading (the sync sidecar fallback, or a broker that can't be reached — which fails open deliberately, rather than stalling the phase). Leave well above the queue-depth setting; it should rarely bind. 0 = uncapped.
A domain whose MX targets protection.outlook.com is classified straight into the three-six-five bucket at P1, before this phase ever runs. Turning this on sends those leads through the SAME realm probe (Tier C / Tier B above) too — one extra outbound check per lead — so their federation detail (Managed vs. Okta / ADFS / Duo / GoDaddy) is captured instead of the coarser three-six-five bucket.
Enter a domain and hit Run to see the pipeline trace.