Credential rows with masked passwords and optional victim log_id.
Stealer search queries live infostealer indexes for emails, usernames, IPs, domains, and Discord IDs. Results are credential-centric rows; when a row includes log_id, you can open the victim manifest and download individual files.
A single email pivot can return rows for banking sites, Discord, Steam, PayPal, and corporate VPN portals, each with site URL and masked password. Rows with log_id unlock the full machine snapshot: cookies, autofills, screenshots, and system metadata.
Result shape
- type: email, username, or other normalized login type
- login / value: the recovered identifier
- password: always masked (••••) in the UI; export policies apply on download
- url or site: where the secret was captured
- log_id: optional pointer to victim file explorer
| Type | Login | Password | URL |
|---|---|---|---|
| analyst@example.com | •••••••• | login.example.com | |
| user | player_2849 | •••••• | discord.com |
| billing@corp.io | •••••••••• | paypal.com |
username ████████_alt
user_id 2849103371
discord 1163586699490762872
profile roblox.com/users/2849103371
Victim file explorer
Clicking log_id loads a folder tree (system info, browsers, cookies, screenshots). API v1 exposes GET /api/v1/stealer/victims/{logId} for the manifest and /files/{fileId} for raw file bytes.
Timing
Stealer and investigation searches can take 30–60 seconds. The UI keeps the request open and shows a notice; API responses may include the same duration hint in headers.
