Stealer Search Guide

Overview

Use the V2 stealer surface to search credential documents and then pivot into victims, manifests, file search, or archive download flows. Stealer data is usually a pivot workflow, not a single lookup. A credential row can point to a victim log, that log can expose a manifest or files, and the same domain can have related subdomains, emails, and credential clusters. Use this guide to understand the workflow:

search credentials when you need URLs, usernames, passwords, domains, or log IDs
require has_log_id=true when you only want results that can pivot into victim data
use investigation fanout when you want one combined investigation response
use Phonebook and subdomain extraction when the starting point is a domain

Search Credentials

Successful stealer searches use the standard envelope. The credential list lives in data.items and quota metadata lives under _meta.

curl -G "https://oathnet.org/api/service/v2/stealer/search" \
  -H "x-api-key: YOUR_API_KEY" \
  --data-urlencode "q=user@example.com" \
  --data-urlencode "has_log_id=true" \
  --data-urlencode "domain[]=google.com"

import requests

response = requests.get(
    "https://oathnet.org/api/service/v2/stealer/search",
    params={
        "q": "user@example.com",
        "has_log_id": True,
        "domain[]": ["google.com"],
    },
    headers={"x-api-key": "YOUR_API_KEY"},
)

payload = response.json()
for item in payload["data"]["items"]:
    print(item.get("url_str"), item.get("username"), item.get("log_id"))

Response Example

{
  "success": true,
  "message": "Stealer search completed",
  "data": {
    "items": [
      {
        "id": "doc_001_abc",
        "log_id": "vic_001_user_xyz",
        "url_str": "https://accounts.google.com/signin",
        "domain": ["google.com"],
        "subdomain": ["accounts.google.com"],
        "path": ["/signin"],
        "username": "user@gmail.com",
        "password": "SecretPass123",
        "email": ["user@gmail.com"],
        "pwned_at": "2024-03-15T10:30:00Z",
        "indexed_at": "2024-03-20T12:00:00Z"
      }
    ],
    "meta": {
      "count": 1,
      "total": 156,
      "took_ms": 12,
      "has_more": true,
      "total_pages": 7
    },
    "next_cursor": "eyJsYXN0X2lkIjoiZG9jXzAwMV9hYmMifQ=="
  },
  "_meta": {
    "lookups": {
      "left_today": 9995
    }
  }
}

Common Filters

The current endpoint supports:

q for auto-detected queries
domain[], subdomain[], path[], username[], password[], email[], ip[], hwid[], and discord_id[]
log_id for a direct victim pivot
has_log_id=true when you only want records that can be traced back to a victim log
from, to, logic, wildcard, cursor, filter, and filter_id

See Structured Filters for the exact JSON grammar, operator behavior, field aliases, and filter merge order.

Subdomain Extraction

GET /service/v2/stealer/subdomain also uses an envelope, but its data payload is not paginated. It returns domain, subdomains, count, and optionally alive_results when alive=true.

curl -G "https://oathnet.org/api/service/v2/stealer/subdomain" \
  -H "x-api-key: YOUR_API_KEY" \
  --data-urlencode "domain=example.com"

Investigation Fanout

Investigation search is the combined API shape for a search workspace. One request fans out across credentials, enriched victims, evidence/properties, file metadata, related credentials, links, relations, and access metadata. Use GET /service/v2/stealer/investigation/search when query parameters are enough. Use POST when you need section-specific filters, cursors, or larger JSON payloads.

curl -X POST "https://oathnet.org/api/service/v2/stealer/investigation/search" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "q": "example.com",
    "search_id": "sess_0123456789abcdef",
    "scope": "all",
    "include": ["credentials", "victims", "evidence", "files", "related_credentials"],
    "compact": true,
    "view": "enriched",
    "page_size": 25,
    "filters": {
      "credentials": {
        "domain": ["example.com"],
        "has_log_id": true
      },
      "victims": {
        "service": ["discord"],
        "country": ["US"]
      },
      "evidence": {
        "service": "discord",
        "confidence": ["high"]
      },
      "files": {
        "kind": "cookies"
      }
    },
    "cursors": {
      "credentials": null,
      "victims": null,
      "evidence": null,
      "files": null,
      "related_credentials": null
    }
  }'

Compact responses place requested sections under data.sections. Non-compact responses may expose the same sections as top-level data.credentials, data.victims, data.evidence, data.files, and data.related_credentials. Use links and relations to explain why records from different sections are connected. If the current plan cannot access a section, the response may include policy_redacted, upgrade_required, redaction_marker, or section_errors.

Phonebook

Phonebook returns domain host and email intelligence. It is useful when the user starts from a domain and wants to understand exposed subdomains, email addresses, counts, latest record dates, and access limits.

curl -G "https://oathnet.org/api/service/v2/phonebook" \
  -H "x-api-key: YOUR_API_KEY" \
  --data-urlencode "domain=example.com" \
  --data-urlencode "search_id=sess_0123456789abcdef"

Phonebook returns raw JSON rather than the standard success/data envelope. The main fields are domain, subdomains, subdomain_results, emails, count, email_count, policy_redacted, visible result limits, and redacted counts. alive and is_alive request live availability checks when the plan permits it.

Next Steps

When a result contains log_id, use the victims endpoints to inspect the log manifest, fetch raw file contents, or launch an async file search job.

Structured Filters

Shared search filter grammar and merge behavior

Victim Workflows

Inspect linked victim logs

File Search

Search inside victim files

API Reference

Use OpenAPI for exact paths, parameters, schemas, and playground requests

Getting Started

Search Guides

OSINT And Utility Guides

Integration Guides

Resources

Overview

Search Credentials

Common Filters

Subdomain Extraction

Investigation Fanout

Phonebook

Next Steps

Structured Filters

Victim Workflows

File Search

API Reference

​Overview

​Search Credentials

​Common Filters

​Subdomain Extraction

​Investigation Fanout

​Phonebook

​Next Steps

Structured Filters

Victim Workflows

File Search

API Reference

Overview

Search Credentials

Common Filters

Subdomain Extraction

Investigation Fanout

Phonebook

Next Steps