v1

latestOpenAPI 3.0.02026-07-24311994.6 KB

End User Protection

Search by Stealer

Search for compromises by stealer ID

post/search-by-stealer

Request body

stealersstring[] required

Array of stealer IDs to search for.

sort_by'date_compromised' | 'date_uploaded'

Field to sort results by. 'date_compromised' sorts by when the infection occurred, while 'date_uploaded' sorts by when the data was integrated into our platform.

sort_direction'asc' | 'desc'

Direction to sort results. 'desc' returns newest records first (recommended for monitoring), while 'asc' returns oldest records first (useful for historical analysis).

typesstring[]

Filter results by credential type. 'employees' returns corporate email credentials (@company.com), 'users' returns consumer credentials, and 'third_parties' returns credentials from related domains (only available when 'domains' parameter is provided).

domainsstring[]

List of domains to filter results by. Accepts root domains (example.com) and will match all subdomains. Maximum 50 domains per request. Required for 'third_parties' type filtering.

keywordsstring[]

Filter results to URLs containing specified keywords. Useful for finding credentials for specific services (e.g., ['vpn', 'admin', 'portal']). Case-insensitive matching. Maximum 10 keywords per request.

keywords_match'any' | 'all'

Determines how multiple keywords are matched. 'any' returns results matching at least one keyword (broader results), while 'all' requires all keywords to match (narrower, more specific results).

filter_credentialsboolean

Controls credential filtering in results. When true, returns only credentials matching the search criteria. When false, returns all credentials from matching stealers, which may include credentials for unrelated domains/services.

cursorstring

Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the 'nextCursor' field in the previous response. Provides more reliable pagination than offset-based approaches.

start_datestring date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter results from this date/time onward. Applies to the field specified in 'sort_by'. Useful for incremental data retrieval and monitoring.

end_datestring date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter results up to this date/time. Applies to the field specified in 'sort_by'. Useful for historical analysis and limiting result timeframes.

additional_fieldsstring[]

Optional additional data to include in results. 'search_data' adds information about the search terms found in the browsing history search engine results from infected devices. 'installed_software' adds information about software installed on compromised machines, useful for vulnerability assessment and attack surface analysis. 'employee_session_cookies' adds session cookies from employee credentials, useful for identifying active sessions and potential unauthorized access. May increase response size and processing time. 'password_strength' adds password strength analysis for each password in the results. 'sensitive_applications' adds information about sensitive applications within the compromised URL structure, based on a predefined list of sensitive apps. 'dir_tree' adds information about the directory tree of the compromised machine, which can help identify potential attack vectors.

Example request

{
  "stealers": [
    "EG_196.158.196.83"
  ],
  "sort_by": "date_compromised",
  "sort_direction": "desc",
  "types": [
    "employees"
  ],
  "domains": [
    "hpe.com"
  ],
  "keywords": [
    "auth",
    "login"
  ],
  "keywords_match": "any",
  "filter_credentials": true
}

Response

Successful search

nextCursorstring

Cursor for the next page of results