V2 Stealer

Search Stealer Records

Current stealer search surface for credential records. Successful responses use the standard search envelope. Use GET for simple query-string filters. Use POST /service/v2/stealer/search when you need to send a structured filter or filter_id in JSON.

Dashboard basic filters:

Credentials: email, domain, subdomain, username, password, path, email_domain, source_type, password_hash, archive_hash, canonical_credential_id.
Victim pivots: ip, hwid, discord_id, country, city, os, service, steam_id, steam_name, phone, identity_state, victim_ip, antivirus, infection_path.
Files (Enterprise): files.q, files.name, files.folder, files.kind, files.ext, files.size_min, files.size_max.
Metadata: log_id, date range via from / to and date_field (pwned_at or indexed_at), plus victim volume via victims.total_docs.

Advanced structured filter fields:

Common: log_id, domain, subdomain, email, email_domain, username, pwned_at, indexed_at, hwid, archive_hash.
Credentials: credentials.id, credentials.log_id, credentials.url, credentials.domain, credentials.subdomain, credentials.email, credentials.email_domain, credentials.username, credentials.password, credentials.path, credentials.source_type, credentials.password_hash, credentials.archive_hash, credentials.canonical_credential_id.
Victims: victims.id, victims.log_id, victims.legacy_log_id, victims.victim_id, victims.archive_hash, victims.country, victims.city, victims.geo_city, victims.ip, victims.victim_ip, victims.email, victims.email_domain, victims.username, victims.domain, victims.subdomain, victims.hwid, victims.os, victims.service, victims.service_count, victims.total_docs, victims.steam_id, victims.steam_name, victims.discord_id, victims.phone, victims.identity_state, victims.antivirus, victims.infection_path.
Victim properties/evidence: evidence.q, evidence.active, evidence.property_type, evidence.service, evidence.identity_kind, evidence.account_id, evidence.username, evidence.display_name, evidence.value, evidence.domain, evidence.source_type, evidence.source_file_id, evidence.confidence, evidence.confidence_min.
File metadata (Enterprise): files.q, files.log_id, files.file_id, files.name, files.folder, files.path, files.kind, files.ext, files.size_bytes, files.size_min, files.size_max.

Bare compatibility fields such as domain, subdomain, username, and archive_hash are accepted and normalized to the matching credential or victim namespace where needed.

GET

https://oathnet.org/api

service

stealer

Search Stealer Records

curl --request GET \
  --url https://oathnet.org/api/service/v2/stealer/search \
  --header 'x-api-key: <api-key>'

const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};

fetch('https://oathnet.org/api/service/v2/stealer/search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://oathnet.org/api/service/v2/stealer/search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://oathnet.org/api/service/v2/stealer/search"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://oathnet.org/api/service/v2/stealer/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "success": true,
  "message": "<string>",
  "data": {
    "items": [
      {
        "id": "<string>",
        "log_id": "<string>",
        "url_str": "<string>",
        "domain": [
          "<string>"
        ],
        "subdomain": [
          "<string>"
        ],
        "email_domains": [
          "<string>"
        ],
        "path": [
          "<string>"
        ],
        "username": "<string>",
        "password": "<string>",
        "email": [
          "<string>"
        ],
        "log": "<string>",
        "source_type": "<string>",
        "password_hash": "<string>",
        "archive_hash": "<string>",
        "canonical_credential_id": "<string>",
        "investigation_labels": [
          "<string>"
        ],
        "investigation_link_types": [
          "<string>"
        ],
        "is_related_credential": true,
        "pwned_at": "2023-11-07T05:31:56Z",
        "indexed_at": "2023-11-07T05:31:56Z"
      }
    ],
    "meta": {
      "count": 123,
      "total": 123,
      "took_ms": 123,
      "has_more": true,
      "total_pages": 123,
      "max_score": 123,
      "filter_id": "0123456789abcdef01234567"
    },
    "next_cursor": "<string>",
    "victims": [
      {
        "log_id": "<string>",
        "device_users": [
          "<string>"
        ],
        "hwids": [
          "<string>"
        ],
        "device_ips": [
          "<string>"
        ],
        "device_emails": [
          "<string>"
        ],
        "discord_ids": [
          "<string>"
        ],
        "total_docs": 123,
        "pwned_at": "2023-11-07T05:31:56Z",
        "indexed_at": "2023-11-07T05:31:56Z",
        "phone_numbers": [
          "<string>"
        ],
        "steam_ids": [
          "<string>"
        ],
        "steam_names": [
          "<string>"
        ],
        "services": [
          "<string>"
        ],
        "service_count": 123,
        "identity_state": "<string>",
        "device_os": "<string>",
        "device_country": "<string>",
        "device_city": "<string>",
        "infection_path": "<string>",
        "antivirus": [
          "<string>"
        ],
        "domains": [
          "<string>"
        ],
        "subdomains": [
          "<string>"
        ],
        "email_domains": [
          "<string>"
        ],
        "victim_ip": "<string>",
        "geo_country": "<string>",
        "geo_city": "<string>"
      }
    ],
    "victims_meta": {
      "count": 123,
      "total": 123,
      "took_ms": 123,
      "has_more": true,
      "total_pages": 123,
      "max_score": 123,
      "filter_id": "0123456789abcdef01234567"
    },
    "victims_next_cursor": "<string>",
    "credential_stats": {
      "direct_total": 123,
      "direct_loaded": 123,
      "linked_total": 123,
      "linked_loaded": 123,
      "total": 123,
      "loaded": 123
    }
  }
}

{
  "success": false,
  "message": "Discord user not found.",
  "errors": {
    "error": "Discord user not found.",
    "status_code": 404,
    "_meta": {
      "user": {
        "plan": "Pro",
        "plan_type": "pro",
        "is_plan_active": true
      },
      "lookups": {
        "used_today": 5,
        "left_today": 995,
        "daily_limit": 1000,
        "is_unlimited": false
      },
      "service": {
        "name": "Service Name",
        "id": "service-id",
        "category": "general",
        "is_premium": false,
        "is_available": true,
        "session_quota": 10
      },
      "performance": {
        "duration_ms": 508.81,
        "timestamp": "2026-01-06T01:07:27.981019"
      }
    }
  }
}

Authorizations

x-api-key

string

header

required

API key for authentication (lowercase header name)

Query Parameters

string

Search query

cursor

string

page_size

integer

sort

string

from

string<date-time>

date_field

enum<string>

Available options:

indexed_at,

pwned_at

log_id

string

has_log_id

boolean

wildcard

boolean

logic

enum<string>

Available options:

and,

or

filter

string

JSON-encoded structured filter tree.

Use leaf nodes with field, operator, and value, or compound nodes with and / or. If you would rather send the filter as a real JSON object, use POST on the same /search route. See /guides/structured-filters for the full grammar, operators, limits, and examples.

filter_id

string

24-character transient filter context ID returned by POST /service/v2/ai/filter or a previous search response.

24-character transient filter context ID.

Pattern: ^[0-9a-fA-F]{24}$

Example:

"0123456789abcdef01234567"

domain[]

string[]

subdomain[]

string[]

username[]

string[]

password[]

string[]

password_hash[]

string[]

path[]

string[]

email[]

string[]

email_domain[]

string[]

ip[]

string[]

hwid[]

string[]

discord_id[]

string[]

source_type[]

string[]

archive_hash[]

string[]

canonical_credential_id[]

string[]

fields[]

string[]

Response field whitelist

search_id

string

view

enum<string>

Available options:

enriched

Response

Stealer search response

success

boolean

message

string

data

object

Show child attributes

Search Stealer Records

curl --request GET \
  --url https://oathnet.org/api/service/v2/stealer/search \
  --header 'x-api-key: <api-key>'

const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};

fetch('https://oathnet.org/api/service/v2/stealer/search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://oathnet.org/api/service/v2/stealer/search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://oathnet.org/api/service/v2/stealer/search"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://oathnet.org/api/service/v2/stealer/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "success": true,
  "message": "<string>",
  "data": {
    "items": [
      {
        "id": "<string>",
        "log_id": "<string>",
        "url_str": "<string>",
        "domain": [
          "<string>"
        ],
        "subdomain": [
          "<string>"
        ],
        "email_domains": [
          "<string>"
        ],
        "path": [
          "<string>"
        ],
        "username": "<string>",
        "password": "<string>",
        "email": [
          "<string>"
        ],
        "log": "<string>",
        "source_type": "<string>",
        "password_hash": "<string>",
        "archive_hash": "<string>",
        "canonical_credential_id": "<string>",
        "investigation_labels": [
          "<string>"
        ],
        "investigation_link_types": [
          "<string>"
        ],
        "is_related_credential": true,
        "pwned_at": "2023-11-07T05:31:56Z",
        "indexed_at": "2023-11-07T05:31:56Z"
      }
    ],
    "meta": {
      "count": 123,
      "total": 123,
      "took_ms": 123,
      "has_more": true,
      "total_pages": 123,
      "max_score": 123,
      "filter_id": "0123456789abcdef01234567"
    },
    "next_cursor": "<string>",
    "victims": [
      {
        "log_id": "<string>",
        "device_users": [
          "<string>"
        ],
        "hwids": [
          "<string>"
        ],
        "device_ips": [
          "<string>"
        ],
        "device_emails": [
          "<string>"
        ],
        "discord_ids": [
          "<string>"
        ],
        "total_docs": 123,
        "pwned_at": "2023-11-07T05:31:56Z",
        "indexed_at": "2023-11-07T05:31:56Z",
        "phone_numbers": [
          "<string>"
        ],
        "steam_ids": [
          "<string>"
        ],
        "steam_names": [
          "<string>"
        ],
        "services": [
          "<string>"
        ],
        "service_count": 123,
        "identity_state": "<string>",
        "device_os": "<string>",
        "device_country": "<string>",
        "device_city": "<string>",
        "infection_path": "<string>",
        "antivirus": [
          "<string>"
        ],
        "domains": [
          "<string>"
        ],
        "subdomains": [
          "<string>"
        ],
        "email_domains": [
          "<string>"
        ],
        "victim_ip": "<string>",
        "geo_country": "<string>",
        "geo_city": "<string>"
      }
    ],
    "victims_meta": {
      "count": 123,
      "total": 123,
      "took_ms": 123,
      "has_more": true,
      "total_pages": 123,
      "max_score": 123,
      "filter_id": "0123456789abcdef01234567"
    },
    "victims_next_cursor": "<string>",
    "credential_stats": {
      "direct_total": 123,
      "direct_loaded": 123,
      "linked_total": 123,
      "linked_loaded": 123,
      "total": 123,
      "loaded": 123
    }
  }
}

{
  "success": false,
  "message": "Discord user not found.",
  "errors": {
    "error": "Discord user not found.",
    "status_code": 404,
    "_meta": {
      "user": {
        "plan": "Pro",
        "plan_type": "pro",
        "is_plan_active": true
      },
      "lookups": {
        "used_today": 5,
        "left_today": 995,
        "daily_limit": 1000,
        "is_unlimited": false
      },
      "service": {
        "name": "Service Name",
        "id": "service-id",
        "category": "general",
        "is_premium": false,
        "is_available": true,
        "session_quota": 10
      },
      "performance": {
        "duration_ms": 508.81,
        "timestamp": "2026-01-06T01:07:27.981019"
      }
    }
  }
}

Overview

Endpoints

Search Stealer Records

Authorizations

Query Parameters

Response