> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oathnet.org/llms.txt
> Use this file to discover all available pages before exploring further.
# Stealer Search Guide
> Search stealer credentials, pivot into victims, and use investigation helpers
## Overview
Use the V2 stealer surface to search credential documents and then pivot into victims, manifests, file search, or archive download flows.
Stealer data is usually a pivot workflow, not a single lookup. A credential row
can point to a victim log, that log can expose a manifest or files, and the same
domain can have related subdomains, emails, and credential clusters.
Use this guide to understand the workflow:
* search credentials when you need URLs, usernames, passwords, domains, or log IDs
* require `has_log_id=true` when you only want results that can pivot into victim data
* use investigation fanout when you want one combined investigation response
* use Phonebook and subdomain extraction when the starting point is a domain
## Search Credentials
Successful stealer searches use the standard envelope. The credential list lives in `data.items` and quota metadata lives under `_meta`.
```bash cURL theme={null}
curl -G "https://oathnet.org/api/service/v2/stealer/search" \
-H "x-api-key: YOUR_API_KEY" \
--data-urlencode "q=user@example.com" \
--data-urlencode "has_log_id=true" \
--data-urlencode "domain[]=google.com"
```
```python Python theme={null}
import requests
response = requests.get(
"https://oathnet.org/api/service/v2/stealer/search",
params={
"q": "user@example.com",
"has_log_id": True,
"domain[]": ["google.com"],
},
headers={"x-api-key": "YOUR_API_KEY"},
)
payload = response.json()
for item in payload["data"]["items"]:
print(item.get("url_str"), item.get("username"), item.get("log_id"))
```
```json Response Example theme={null}
{
"success": true,
"message": "Stealer search completed",
"data": {
"items": [
{
"id": "doc_001_abc",
"log_id": "vic_001_user_xyz",
"url_str": "https://accounts.google.com/signin",
"domain": ["google.com"],
"subdomain": ["accounts.google.com"],
"path": ["/signin"],
"username": "user@gmail.com",
"password": "SecretPass123",
"email": ["user@gmail.com"],
"pwned_at": "2024-03-15T10:30:00Z",
"indexed_at": "2024-03-20T12:00:00Z"
}
],
"meta": {
"count": 1,
"total": 156,
"took_ms": 12,
"has_more": true,
"total_pages": 7
},
"next_cursor": "eyJsYXN0X2lkIjoiZG9jXzAwMV9hYmMifQ=="
},
"_meta": {
"lookups": {
"left_today": 9995
}
}
}
```
## Common Filters
The current endpoint supports:
* `q` for auto-detected queries
* `domain[]`, `subdomain[]`, `path[]`, `username[]`, `password[]`, `email[]`, `ip[]`, `hwid[]`, and `discord_id[]`
* `log_id` for a direct victim pivot
* `has_log_id=true` when you only want records that can be traced back to a victim log
* `from`, `to`, `logic`, `wildcard`, `cursor`, `filter`, and `filter_id`
See [Structured Filters](/guides/structured-filters) for the exact JSON grammar, operator behavior, field aliases, and filter merge order.
## Subdomain Extraction
`GET /service/v2/stealer/subdomain` also uses an envelope, but its `data` payload is not paginated. It returns `domain`, `subdomains`, `count`, and optionally `alive_results` when `alive=true`.
```bash theme={null}
curl -G "https://oathnet.org/api/service/v2/stealer/subdomain" \
-H "x-api-key: YOUR_API_KEY" \
--data-urlencode "domain=example.com"
```
## Investigation Fanout
Investigation search is the combined API shape for a search workspace.
One request fans out across credentials, enriched victims, evidence/properties,
file metadata, related credentials, links, relations, and access metadata.
Use `GET /service/v2/stealer/investigation/search` when query parameters are
enough. Use `POST` when you need section-specific filters, cursors, or larger
JSON payloads.
```bash theme={null}
curl -X POST "https://oathnet.org/api/service/v2/stealer/investigation/search" \
-H "x-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"q": "example.com",
"search_id": "sess_0123456789abcdef",
"scope": "all",
"include": ["credentials", "victims", "evidence", "files", "related_credentials"],
"compact": true,
"view": "enriched",
"page_size": 25,
"filters": {
"credentials": {
"domain": ["example.com"],
"has_log_id": true
},
"victims": {
"service": ["discord"],
"country": ["US"]
},
"evidence": {
"service": "discord",
"confidence": ["high"]
},
"files": {
"kind": "cookies"
}
},
"cursors": {
"credentials": null,
"victims": null,
"evidence": null,
"files": null,
"related_credentials": null
}
}'
```
Compact responses place requested sections under `data.sections`. Non-compact
responses may expose the same sections as top-level `data.credentials`,
`data.victims`, `data.evidence`, `data.files`, and
`data.related_credentials`.
Use `links` and `relations` to explain why records from different sections are
connected. If the current plan cannot access a section, the response may include
`policy_redacted`, `upgrade_required`, `redaction_marker`, or `section_errors`.
## Phonebook
Phonebook returns domain host and email intelligence. It is useful when the user
starts from a domain and wants to understand exposed subdomains, email
addresses, counts, latest record dates, and access limits.
```bash theme={null}
curl -G "https://oathnet.org/api/service/v2/phonebook" \
-H "x-api-key: YOUR_API_KEY" \
--data-urlencode "domain=example.com" \
--data-urlencode "search_id=sess_0123456789abcdef"
```
Phonebook returns raw JSON rather than the standard `success/data` envelope. The
main fields are `domain`, `subdomains`, `subdomain_results`, `emails`, `count`,
`email_count`, `policy_redacted`, visible result limits, and redacted counts.
`alive` and `is_alive` request live availability checks when the plan permits
it.
## Next Steps
When a result contains `log_id`, use the victims endpoints to inspect the log manifest, fetch raw file contents, or launch an async file search job.
Shared search filter grammar and merge behavior
Inspect linked victim logs
Search inside victim files
Use OpenAPI for exact paths, parameters, schemas, and playground requests