V2 Victims

Search Victim Profiles

Search victim summaries keyed by log_id. Successful responses use the standard search envelope. The same route also accepts POST when you want to send filter or filter_id in the JSON request body instead of the query string.

Dashboard victim filters:

Identity and contact: email, email_domain, username, discord_id, phone, steam_id, steam_name.
Device and network: ip, victim_ip, hwid, os, antivirus, infection_path.
Geography and service: country, city, domain, subdomain, service, identity_state.
Volume and richness: total_docs_min, total_docs_max, service_count_min, service_count_max.
Metadata: log_id, date range via from / to and date_field (pwned_at or indexed_at).

Structured filters can use the same bare victim field names above. When a filter is built from the full stealer investigation view, namespaced fields such as victims.country, victims.service, and victims.total_docs are projected to country, service, and total_docs for this direct victim search endpoint.

GET

https://oathnet.org/api

service

victims

Search Victim Profiles

curl --request GET \
  --url https://oathnet.org/api/service/v2/victims/search \
  --header 'x-api-key: <api-key>'

const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};

fetch('https://oathnet.org/api/service/v2/victims/search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://oathnet.org/api/service/v2/victims/search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://oathnet.org/api/service/v2/victims/search"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://oathnet.org/api/service/v2/victims/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "success": true,
  "message": "<string>",
  "data": {
    "items": [
      {
        "log_id": "<string>",
        "device_users": [
          "<string>"
        ],
        "hwids": [
          "<string>"
        ],
        "device_ips": [
          "<string>"
        ],
        "device_emails": [
          "<string>"
        ],
        "discord_ids": [
          "<string>"
        ],
        "total_docs": 123,
        "pwned_at": "2023-11-07T05:31:56Z",
        "indexed_at": "2023-11-07T05:31:56Z",
        "phone_numbers": [
          "<string>"
        ],
        "steam_ids": [
          "<string>"
        ],
        "steam_names": [
          "<string>"
        ],
        "services": [
          "<string>"
        ],
        "service_count": 123,
        "identity_state": "<string>",
        "device_os": "<string>",
        "device_country": "<string>",
        "device_city": "<string>",
        "infection_path": "<string>",
        "antivirus": [
          "<string>"
        ],
        "domains": [
          "<string>"
        ],
        "subdomains": [
          "<string>"
        ],
        "email_domains": [
          "<string>"
        ],
        "victim_ip": "<string>",
        "geo_country": "<string>",
        "geo_city": "<string>"
      }
    ],
    "meta": {
      "count": 123,
      "total": 123,
      "took_ms": 123,
      "has_more": true,
      "total_pages": 123,
      "max_score": 123,
      "filter_id": "0123456789abcdef01234567"
    },
    "next_cursor": "<string>"
  }
}

Authorizations

x-api-key

string

header

required

API key for authentication (lowercase header name)

Query Parameters

string

cursor

string

page_size

integer

sort

string

from

string<date-time>

date_field

enum<string>

Available options:

indexed_at,

pwned_at

wildcard

boolean

log_id

string

filter

string

JSON-encoded structured filter tree.

Use leaf nodes with field, operator, and value, or compound nodes with and / or. If you would rather send the filter as a real JSON object, use POST on the same /search route. See /guides/structured-filters for the full grammar, operators, limits, and examples.

filter_id

string

24-character transient filter context ID returned by POST /service/v2/ai/filter or a previous search response.

24-character transient filter context ID.

Pattern: ^[0-9a-fA-F]{24}$

Example:

"0123456789abcdef01234567"

total_docs_min

integer

total_docs_max

integer

service_count_min

integer

service_count_max

integer

email[]

string[]

email_domain[]

string[]

ip[]

string[]

hwid[]

string[]

discord_id[]

string[]

username[]

string[]

country[]

string[]

city[]

string[]

os[]

string[]

service[]

string[]

steam_id[]

string[]

steam_name[]

string[]

phone[]

string[]

domain[]

string[]

subdomain[]

string[]

identity_state[]

string[]

victim_ip[]

string[]

antivirus[]

string[]

infection_path[]

string[]

fields[]

string[]

view

enum<string>

Available options:

enriched

search_id

string

Search session ID from POST /service/search/init.

Response

200 - application/json

Victim search response

success

boolean

message

string

data

object

Show child attributes

Search Victim Profiles

curl --request GET \
  --url https://oathnet.org/api/service/v2/victims/search \
  --header 'x-api-key: <api-key>'

const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};

fetch('https://oathnet.org/api/service/v2/victims/search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://oathnet.org/api/service/v2/victims/search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://oathnet.org/api/service/v2/victims/search"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://oathnet.org/api/service/v2/victims/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "success": true,
  "message": "<string>",
  "data": {
    "items": [
      {
        "log_id": "<string>",
        "device_users": [
          "<string>"
        ],
        "hwids": [
          "<string>"
        ],
        "device_ips": [
          "<string>"
        ],
        "device_emails": [
          "<string>"
        ],
        "discord_ids": [
          "<string>"
        ],
        "total_docs": 123,
        "pwned_at": "2023-11-07T05:31:56Z",
        "indexed_at": "2023-11-07T05:31:56Z",
        "phone_numbers": [
          "<string>"
        ],
        "steam_ids": [
          "<string>"
        ],
        "steam_names": [
          "<string>"
        ],
        "services": [
          "<string>"
        ],
        "service_count": 123,
        "identity_state": "<string>",
        "device_os": "<string>",
        "device_country": "<string>",
        "device_city": "<string>",
        "infection_path": "<string>",
        "antivirus": [
          "<string>"
        ],
        "domains": [
          "<string>"
        ],
        "subdomains": [
          "<string>"
        ],
        "email_domains": [
          "<string>"
        ],
        "victim_ip": "<string>",
        "geo_country": "<string>",
        "geo_city": "<string>"
      }
    ],
    "meta": {
      "count": 123,
      "total": 123,
      "took_ms": 123,
      "has_more": true,
      "total_pages": 123,
      "max_score": 123,
      "filter_id": "0123456789abcdef01234567"
    },
    "next_cursor": "<string>"
  }
}

Overview

Endpoints

Search Victim Profiles

Authorizations

Query Parameters

Response