---
title: "Infection Analysis (NEW)"
method: POST
path: "/search-by-stealer/infection-analysis"
tags: ["Investigations"]
---

# Infection Analysis (NEW)

`POST /search-by-stealer/infection-analysis`

Get infection analysis for a stealer. This endpoint analyzes browser history to identify the likely infection source and infection flow. Currently only supported for stealers where we collect and store browsing history (mainly Lumma).

## Request body

- object
  - `stealer` string — Stealer ID to get infection analysis for. Currently only supports stealers where we collect browsing history (mainly Lumma stealer)

## Response `200`

Successful operation

- object
  - `data` object
    - `likely_infection_url` string — URL identified as the most likely infection source
    - `infection_confidence` number, float — Confidence score for the infection analysis (0-1)
    - `infection_reasoning` string — Explanation of why the URL was identified as the infection source
    - `infection_flow` object[] — Chronological sequence of URLs visited that led to the infection
      - `timestamp` string, date-time — Timestamp of the infection event
      - `url` string — URL visited during the infection flow
      - `notes` string — Analysis notes about this specific URL in the infection chain
    - `analyst_summary` string — Concise summary of the infection analysis

## Other responses

- `400` — Validation error - the request or request body was invalid
- `401` — Unauthorized - the server could not authenticate the request
- `403` — Forbidden - the server authenticated the request but refuses to process it because of insufficient permissions
- `404` — Not found - the server could not find the requested resource
- `408` — Timeout - the server timed out while waiting for a response (90 seconds)
- `429` — Rate limit exceeded - the server has received too many requests in a short period of time
- `500` — Internal server error - the server encountered an unexpected condition that prevented it from fulfilling the request

---

[API](https://skmtc.net/hudsonrock/apis/cavalier-api.md) · [All operations](https://skmtc.net/hudsonrock/apis/cavalier-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hudsonrock/cavalier-api/revisions/5ba0142eec4d/schema)