Investigate Stealer Data

curl --request GET \
  --url https://oathnet.org/api/service/v2/stealer/investigation/search \
  --header 'x-api-key: <api-key>'

import requests

url = "https://oathnet.org/api/service/v2/stealer/investigation/search"

headers = {"x-api-key": "<api-key>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};

fetch('https://oathnet.org/api/service/v2/stealer/investigation/search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://oathnet.org/api/service/v2/stealer/investigation/search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://oathnet.org/api/service/v2/stealer/investigation/search"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://oathnet.org/api/service/v2/stealer/investigation/search")
  .header("x-api-key", "<api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://oathnet.org/api/service/v2/stealer/investigation/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "success": true,
  "message": "<string>",
  "data": {
    "query": "<string>",
    "scope": "<string>",
    "sections": {
      "credentials": {
        "items": [
          {
            "id": "<string>",
            "log_id": "<string>",
            "url_str": "<string>",
            "domain": [
              "<string>"
            ],
            "subdomain": [
              "<string>"
            ],
            "email_domains": [
              "<string>"
            ],
            "path": [
              "<string>"
            ],
            "username": "<string>",
            "password": "<string>",
            "email": [
              "<string>"
            ],
            "log": "<string>",
            "source_type": "<string>",
            "password_hash": "<string>",
            "archive_hash": "<string>",
            "canonical_credential_id": "<string>",
            "investigation_labels": [
              "<string>"
            ],
            "investigation_link_types": [
              "<string>"
            ],
            "is_related_credential": true,
            "pwned_at": "2023-11-07T05:31:56Z",
            "indexed_at": "2023-11-07T05:31:56Z"
          }
        ],
        "meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "next_cursor": "<string>",
        "victims": [
          {
            "log_id": "<string>",
            "device_users": [
              "<string>"
            ],
            "hwids": [
              "<string>"
            ],
            "device_ips": [
              "<string>"
            ],
            "device_emails": [
              "<string>"
            ],
            "discord_ids": [
              "<string>"
            ],
            "total_docs": 123,
            "pwned_at": "2023-11-07T05:31:56Z",
            "indexed_at": "2023-11-07T05:31:56Z",
            "phone_numbers": [
              "<string>"
            ],
            "steam_ids": [
              "<string>"
            ],
            "steam_names": [
              "<string>"
            ],
            "services": [
              "<string>"
            ],
            "service_count": 123,
            "identity_state": "<string>",
            "device_os": "<string>",
            "device_country": "<string>",
            "device_city": "<string>",
            "infection_path": "<string>",
            "antivirus": [
              "<string>"
            ],
            "domains": [
              "<string>"
            ],
            "subdomains": [
              "<string>"
            ],
            "email_domains": [
              "<string>"
            ],
            "victim_ip": "<string>",
            "geo_country": "<string>",
            "geo_city": "<string>"
          }
        ],
        "victims_meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "victims_next_cursor": "<string>",
        "credential_stats": {
          "direct_total": 123,
          "direct_loaded": 123,
          "linked_total": 123,
          "linked_loaded": 123,
          "total": 123,
          "loaded": 123
        }
      },
      "victims": {
        "items": [
          {
            "log_id": "<string>",
            "device_users": [
              "<string>"
            ],
            "hwids": [
              "<string>"
            ],
            "device_ips": [
              "<string>"
            ],
            "device_emails": [
              "<string>"
            ],
            "discord_ids": [
              "<string>"
            ],
            "total_docs": 123,
            "pwned_at": "2023-11-07T05:31:56Z",
            "indexed_at": "2023-11-07T05:31:56Z",
            "phone_numbers": [
              "<string>"
            ],
            "steam_ids": [
              "<string>"
            ],
            "steam_names": [
              "<string>"
            ],
            "services": [
              "<string>"
            ],
            "service_count": 123,
            "identity_state": "<string>",
            "device_os": "<string>",
            "device_country": "<string>",
            "device_city": "<string>",
            "infection_path": "<string>",
            "antivirus": [
              "<string>"
            ],
            "domains": [
              "<string>"
            ],
            "subdomains": [
              "<string>"
            ],
            "email_domains": [
              "<string>"
            ],
            "victim_ip": "<string>",
            "geo_country": "<string>",
            "geo_city": "<string>"
          }
        ],
        "meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "next_cursor": "<string>"
      },
      "evidence": {
        "items": [
          {
            "log_id": "<string>",
            "property_id": "<string>",
            "property_type": "<string>",
            "service": "<string>",
            "identity_kind": "<string>",
            "account_id": "<string>",
            "username": "<string>",
            "display_name": "<string>",
            "value": "<string>",
            "domain": "<string>",
            "active": true,
            "source_type": "<string>",
            "source_path": "<string>",
            "source_file_id": "<string>",
            "confidence": 123,
            "confidence_label": "<string>",
            "confidence_score": 123,
            "indexed_at": "2023-11-07T05:31:56Z"
          }
        ],
        "meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "next_cursor": "<string>",
        "policy_redacted": true,
        "upgrade_required": true,
        "redaction_marker": "<string>"
      },
      "files": {
        "items": [
          {
            "log_id": "<string>",
            "file_id": "<string>",
            "name": "<string>",
            "folder": "<string>",
            "path": "<string>",
            "ext": "<string>",
            "kind": "<string>",
            "size_bytes": 123
          }
        ],
        "meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "next_cursor": "<string>",
        "policy_redacted": true,
        "upgrade_required": true,
        "redaction_marker": "<string>"
      },
      "related_credentials": {
        "items": [
          {
            "id": "<string>",
            "log_id": "<string>",
            "url_str": "<string>",
            "domain": [
              "<string>"
            ],
            "subdomain": [
              "<string>"
            ],
            "email_domains": [
              "<string>"
            ],
            "path": [
              "<string>"
            ],
            "username": "<string>",
            "password": "<string>",
            "email": [
              "<string>"
            ],
            "log": "<string>",
            "source_type": "<string>",
            "password_hash": "<string>",
            "archive_hash": "<string>",
            "canonical_credential_id": "<string>",
            "investigation_labels": [
              "<string>"
            ],
            "investigation_link_types": [
              "<string>"
            ],
            "is_related_credential": true,
            "pwned_at": "2023-11-07T05:31:56Z",
            "indexed_at": "2023-11-07T05:31:56Z"
          }
        ],
        "meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "next_cursor": "<string>",
        "victims": [
          {
            "log_id": "<string>",
            "device_users": [
              "<string>"
            ],
            "hwids": [
              "<string>"
            ],
            "device_ips": [
              "<string>"
            ],
            "device_emails": [
              "<string>"
            ],
            "discord_ids": [
              "<string>"
            ],
            "total_docs": 123,
            "pwned_at": "2023-11-07T05:31:56Z",
            "indexed_at": "2023-11-07T05:31:56Z",
            "phone_numbers": [
              "<string>"
            ],
            "steam_ids": [
              "<string>"
            ],
            "steam_names": [
              "<string>"
            ],
            "services": [
              "<string>"
            ],
            "service_count": 123,
            "identity_state": "<string>",
            "device_os": "<string>",
            "device_country": "<string>",
            "device_city": "<string>",
            "infection_path": "<string>",
            "antivirus": [
              "<string>"
            ],
            "domains": [
              "<string>"
            ],
            "subdomains": [
              "<string>"
            ],
            "email_domains": [
              "<string>"
            ],
            "victim_ip": "<string>",
            "geo_country": "<string>",
            "geo_city": "<string>"
          }
        ],
        "victims_meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "victims_next_cursor": "<string>",
        "credential_stats": {
          "direct_total": 123,
          "direct_loaded": 123,
          "linked_total": 123,
          "linked_loaded": 123,
          "total": 123,
          "loaded": 123
        }
      }
    },
    "credentials": {
      "items": [
        {
          "id": "<string>",
          "log_id": "<string>",
          "url_str": "<string>",
          "domain": [
            "<string>"
          ],
          "subdomain": [
            "<string>"
          ],
          "email_domains": [
            "<string>"
          ],
          "path": [
            "<string>"
          ],
          "username": "<string>",
          "password": "<string>",
          "email": [
            "<string>"
          ],
          "log": "<string>",
          "source_type": "<string>",
          "password_hash": "<string>",
          "archive_hash": "<string>",
          "canonical_credential_id": "<string>",
          "investigation_labels": [
            "<string>"
          ],
          "investigation_link_types": [
            "<string>"
          ],
          "is_related_credential": true,
          "pwned_at": "2023-11-07T05:31:56Z",
          "indexed_at": "2023-11-07T05:31:56Z"
        }
      ],
      "meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "next_cursor": "<string>",
      "victims": [
        {
          "log_id": "<string>",
          "device_users": [
            "<string>"
          ],
          "hwids": [
            "<string>"
          ],
          "device_ips": [
            "<string>"
          ],
          "device_emails": [
            "<string>"
          ],
          "discord_ids": [
            "<string>"
          ],
          "total_docs": 123,
          "pwned_at": "2023-11-07T05:31:56Z",
          "indexed_at": "2023-11-07T05:31:56Z",
          "phone_numbers": [
            "<string>"
          ],
          "steam_ids": [
            "<string>"
          ],
          "steam_names": [
            "<string>"
          ],
          "services": [
            "<string>"
          ],
          "service_count": 123,
          "identity_state": "<string>",
          "device_os": "<string>",
          "device_country": "<string>",
          "device_city": "<string>",
          "infection_path": "<string>",
          "antivirus": [
            "<string>"
          ],
          "domains": [
            "<string>"
          ],
          "subdomains": [
            "<string>"
          ],
          "email_domains": [
            "<string>"
          ],
          "victim_ip": "<string>",
          "geo_country": "<string>",
          "geo_city": "<string>"
        }
      ],
      "victims_meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "victims_next_cursor": "<string>",
      "credential_stats": {
        "direct_total": 123,
        "direct_loaded": 123,
        "linked_total": 123,
        "linked_loaded": 123,
        "total": 123,
        "loaded": 123
      }
    },
    "victims": {
      "items": [
        {
          "log_id": "<string>",
          "device_users": [
            "<string>"
          ],
          "hwids": [
            "<string>"
          ],
          "device_ips": [
            "<string>"
          ],
          "device_emails": [
            "<string>"
          ],
          "discord_ids": [
            "<string>"
          ],
          "total_docs": 123,
          "pwned_at": "2023-11-07T05:31:56Z",
          "indexed_at": "2023-11-07T05:31:56Z",
          "phone_numbers": [
            "<string>"
          ],
          "steam_ids": [
            "<string>"
          ],
          "steam_names": [
            "<string>"
          ],
          "services": [
            "<string>"
          ],
          "service_count": 123,
          "identity_state": "<string>",
          "device_os": "<string>",
          "device_country": "<string>",
          "device_city": "<string>",
          "infection_path": "<string>",
          "antivirus": [
            "<string>"
          ],
          "domains": [
            "<string>"
          ],
          "subdomains": [
            "<string>"
          ],
          "email_domains": [
            "<string>"
          ],
          "victim_ip": "<string>",
          "geo_country": "<string>",
          "geo_city": "<string>"
        }
      ],
      "meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "next_cursor": "<string>"
    },
    "evidence": {
      "items": [
        {
          "log_id": "<string>",
          "property_id": "<string>",
          "property_type": "<string>",
          "service": "<string>",
          "identity_kind": "<string>",
          "account_id": "<string>",
          "username": "<string>",
          "display_name": "<string>",
          "value": "<string>",
          "domain": "<string>",
          "active": true,
          "source_type": "<string>",
          "source_path": "<string>",
          "source_file_id": "<string>",
          "confidence": 123,
          "confidence_label": "<string>",
          "confidence_score": 123,
          "indexed_at": "2023-11-07T05:31:56Z"
        }
      ],
      "meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "next_cursor": "<string>",
      "policy_redacted": true,
      "upgrade_required": true,
      "redaction_marker": "<string>"
    },
    "properties": {
      "items": [
        {
          "log_id": "<string>",
          "property_id": "<string>",
          "property_type": "<string>",
          "service": "<string>",
          "identity_kind": "<string>",
          "account_id": "<string>",
          "username": "<string>",
          "display_name": "<string>",
          "value": "<string>",
          "domain": "<string>",
          "active": true,
          "source_type": "<string>",
          "source_path": "<string>",
          "source_file_id": "<string>",
          "confidence": 123,
          "confidence_label": "<string>",
          "confidence_score": 123,
          "indexed_at": "2023-11-07T05:31:56Z"
        }
      ],
      "meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "next_cursor": "<string>",
      "policy_redacted": true,
      "upgrade_required": true,
      "redaction_marker": "<string>"
    },
    "files": {
      "items": [
        {
          "log_id": "<string>",
          "file_id": "<string>",
          "name": "<string>",
          "folder": "<string>",
          "path": "<string>",
          "ext": "<string>",
          "kind": "<string>",
          "size_bytes": 123
        }
      ],
      "meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "next_cursor": "<string>",
      "policy_redacted": true,
      "upgrade_required": true,
      "redaction_marker": "<string>"
    },
    "related_credentials": {
      "items": [
        {
          "id": "<string>",
          "log_id": "<string>",
          "url_str": "<string>",
          "domain": [
            "<string>"
          ],
          "subdomain": [
            "<string>"
          ],
          "email_domains": [
            "<string>"
          ],
          "path": [
            "<string>"
          ],
          "username": "<string>",
          "password": "<string>",
          "email": [
            "<string>"
          ],
          "log": "<string>",
          "source_type": "<string>",
          "password_hash": "<string>",
          "archive_hash": "<string>",
          "canonical_credential_id": "<string>",
          "investigation_labels": [
            "<string>"
          ],
          "investigation_link_types": [
            "<string>"
          ],
          "is_related_credential": true,
          "pwned_at": "2023-11-07T05:31:56Z",
          "indexed_at": "2023-11-07T05:31:56Z"
        }
      ],
      "meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "next_cursor": "<string>",
      "victims": [
        {
          "log_id": "<string>",
          "device_users": [
            "<string>"
          ],
          "hwids": [
            "<string>"
          ],
          "device_ips": [
            "<string>"
          ],
          "device_emails": [
            "<string>"
          ],
          "discord_ids": [
            "<string>"
          ],
          "total_docs": 123,
          "pwned_at": "2023-11-07T05:31:56Z",
          "indexed_at": "2023-11-07T05:31:56Z",
          "phone_numbers": [
            "<string>"
          ],
          "steam_ids": [
            "<string>"
          ],
          "steam_names": [
            "<string>"
          ],
          "services": [
            "<string>"
          ],
          "service_count": 123,
          "identity_state": "<string>",
          "device_os": "<string>",
          "device_country": "<string>",
          "device_city": "<string>",
          "infection_path": "<string>",
          "antivirus": [
            "<string>"
          ],
          "domains": [
            "<string>"
          ],
          "subdomains": [
            "<string>"
          ],
          "email_domains": [
            "<string>"
          ],
          "victim_ip": "<string>",
          "geo_country": "<string>",
          "geo_city": "<string>"
        }
      ],
      "victims_meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "victims_next_cursor": "<string>",
      "credential_stats": {
        "direct_total": 123,
        "direct_loaded": 123,
        "linked_total": 123,
        "linked_loaded": 123,
        "total": 123,
        "loaded": 123
      }
    },
    "links": [
      {
        "relation_type": "<string>",
        "display_label": "<string>",
        "log_id": "<string>",
        "source": {
          "section": "<string>",
          "id": "<string>",
          "log_id": "<string>"
        },
        "target": {
          "section": "<string>",
          "id": "<string>",
          "log_id": "<string>"
        },
        "matched_field": "<string>",
        "matched_value_label": "<string>",
        "credential_id": "<string>",
        "property_id": "<string>",
        "file_id": "<string>",
        "confidence": 123,
        "reason": "<string>"
      }
    ],
    "relations": [
      {
        "type": "<string>",
        "log_id": "<string>",
        "credential_id": "<string>",
        "property_id": "<string>",
        "file_id": "<string>",
        "reason": "<string>",
        "evidence": "<string>"
      }
    ],
    "section_errors": {},
    "intersection": {
      "mode": "<string>",
      "applied": true,
      "constraints": {},
      "candidate_cap": 123,
      "truncated": true
    },
    "policy_redacted": true,
    "upgrade_required": true,
    "redaction_marker": "<string>"
  }
}