v1

latestOpenAPI 3.0.02026-07-24311994.6 KB

Investigations

Infection Analysis (NEW)

Get infection analysis for a stealer. This endpoint analyzes browser history to identify the likely infection source and infection flow. Currently only supported for stealers where we collect and store browsing history (mainly Lumma).

post/search-by-stealer/infection-analysis

Request body

stealerstring

Stealer ID to get infection analysis for. Currently only supports stealers where we collect browsing history (mainly Lumma stealer)

Example request

{
  "stealer": "[IN]175.101.37.65"
}

Response

Successful operation

Example response

{
  "data": {
    "likely_infection_url": "https://www.mediafire.com/file_premium/psx65h6kf34z9lr/Adobe.Premiere.Pro.2025.v28.3.1.rar/file",
    "infection_confidence": 0.95,
    "infection_reasoning": "The URL is related to downloading movies and matches a pattern often associated with distributing pirated content, which is known for bundling malware.",
    "analyst_summary": "The user likely got infected by visiting 'vegamovies.af', a known site for pirated movie downloads."
  }
}