Victim Workflows Guide

Overview

Victim workflows start after you have a log_id from stealer search, investigation search, file metadata, or a saved result. The victim APIs help you move from “this log exists” to “what is inside this log?” There are three response styles to keep straight:

victim search returns the standard success, message, data, and _meta envelope
manifests return raw JSON because they are file trees, not search result pages
file reads and archive downloads return raw text, bytes, or ZIP streams

Search Victim Summaries

Victim search returns aggregated metadata that helps you decide which logs to inspect next.

curl -G "https://oathnet.org/api/service/v2/victims/search" \
  -H "x-api-key: YOUR_API_KEY" \
  --data-urlencode "q=user@example.com" \
  --data-urlencode "total_docs_min=10"

import requests

response = requests.get(
    "https://oathnet.org/api/service/v2/victims/search",
    params={
        "q": "user@example.com",
        "total_docs_min": 10,
    },
    headers={"x-api-key": "YOUR_API_KEY"},
)

payload = response.json()
for victim in payload["data"]["items"]:
    print(victim["log_id"], victim.get("device_user_str"), victim.get("total_docs"))

Response Example

{
  "success": true,
  "message": "Victims search completed",
  "data": {
    "items": [
      {
        "log_id": "vic_002_gamer_dragonslayer",
        "device_user_str": ["xX_DragonSlayer_Xx", "Tyler"],
        "hwids_str": ["GAMER-PC-HWID-9999"],
        "device_ips": ["73.45.123.89"],
        "device_emails_str": ["progamer2024@gmail.com"],
        "discord_ids": ["396488966779392318"],
        "total_docs": 54,
        "pwned_at": "2024-03-15T10:30:00Z",
        "indexed_at": "2024-11-24T12:00:00Z"
      }
    ],
    "meta": {
      "count": 1,
      "total": 1,
      "took_ms": 10,
      "has_more": false,
      "total_pages": 1
    },
    "next_cursor": null
  },
  "_meta": {
    "lookups": {
      "left_today": 9990
    }
  }
}

Victim search supports the same structured filter and filter_id system as the other V2 search endpoints. See Structured Filters for the operator matrix and the victims-specific field aliases.

Get The Manifest

The manifest endpoint is different: it returns raw JSON with log_id, optional log_name, and victim_tree. There is no {success, data} wrapper. If the log came from a search session, pass the same search_id so the follow-up request stays attached to that investigation.

curl -G "https://oathnet.org/api/service/v2/victims/vic_002_gamer_dragonslayer" \
  --data-urlencode "search_id=sess_0123456789abcdef" \
  -H "x-api-key: YOUR_API_KEY"

{
  "log_id": "vic_002_gamer_dragonslayer",
  "log_name": "xX_DragonSlayer_Xx",
  "victim_tree": {
    "id": "root",
    "name": "StealerLog",
    "type": "directory",
    "children": [
      {
        "id": "creds_passwords",
        "name": "passwords.txt",
        "type": "file",
        "size_bytes": 4521
      }
    ]
  }
}

Get A File

GET /service/v2/victims/{log_id}/files/{file_id} returns the file itself. For text files, read .text. For binary files, read bytes. Always URL-encode log_id and file_id if they contain slashes, spaces, or path-like names from the manifest.

import requests

response = requests.get(
    "https://oathnet.org/api/service/v2/victims/vic_002_gamer_dragonslayer/files/creds_passwords",
    params={"search_id": "sess_0123456789abcdef"},
    headers={"x-api-key": "YOUR_API_KEY"},
)

print(response.text)

Download The Archive

GET /service/v2/victims/{log_id}/archive streams a ZIP archive. Treat it as a download, not JSON.

curl -G "https://oathnet.org/api/service/v2/victims/vic_002_gamer_dragonslayer/archive" \
  --data-urlencode "search_id=sess_0123456789abcdef" \
  -H "x-api-key: YOUR_API_KEY" \
  -o victim_archive.zip

Stealer Search

Find credential rows that include log_id

File Search

Search inside selected logs before downloading files

Exports

Export larger result sets after a search workflow

API Reference

Use OpenAPI for exact paths, parameters, schemas, and stream responses

Getting Started

Search Guides

OSINT And Utility Guides

Integration Guides

Resources

Victim Workflows Guide

Overview

Search Victim Summaries

Get The Manifest

Get A File

Download The Archive

Stealer Search

File Search

Exports

API Reference

​Overview

​Search Victim Summaries

​Get The Manifest

​Get A File

​Download The Archive

Stealer Search

File Search

Exports

API Reference

Overview

Search Victim Summaries

Get The Manifest

Get A File

Download The Archive