> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Stealer logs
> Search the credential corpus by infected machine — each hit is a full stealer-log capture, with a bot record and screenshots you pull on demand.
A stealer log is what info-stealer malware carries off a machine it infected: every password the browser had saved, the cookies, the autofill and form data, the system fingerprint — and usually a screenshot of the desktop at the moment of infection. **Stealer logs** searches the credential corpus by that capture. Each result is one infected machine, not one credential.
That's the difference from the other three approaches. [Raw Data](/api/guides/credentials-raw-sweep), [the ULP feed](/api/guides/credentials-ulp-feed), and [Filtered credentials](/api/guides/credentials-filtered) flatten a stealer log into individual `login` / `password` / `website` rows and fold them into everything else. This one keeps the capture whole and hands you the link back to it: the full **bot record** and the **screenshots**, fetched on demand.
**A stealer-log record stands for a whole machine, not a single credential.** The match surfaced because info-stealer malware ran on someone's device and exfiltrated its browser — so one record represents everything that machine held: every saved login, every session cookie, the autofill, the screenshots, not just the credential your query matched. That's why the response hands you a link to the full capture instead of a single row. The endpoints below are built around pulling that whole record.
### How it works
Stealer logs is an **asynchronous, organization-scoped** flow — the same create → poll → read shape as [Filtered credentials](/api/guides/credentials-filtered), not the one-shot Lucene query of Raw Data or the ULP feed. You submit a search, poll the task until it's ready, read the matched records, then fetch each capture behind the URLs those records hand you.
All four endpoints live under the **Leaks** tag in the [API reference](https://client-api.leak.center/scalar-docs/#tag/leaks).
[`stealer_logs_search`](https://client-api.leak.center/scalar-docs/#tag/leaks/POST/api/service/stealer_logs_search/) starts the task. The body is a single `query` — a domain, email, or username, 3–1024 characters. It comes back with a task `id` and a `status`.
```bash theme={"dark"}
curl https://client-api.leak.center/api/service/stealer_logs_search/ \
-X POST \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{"query": "acme.com"}'
```
```json theme={"dark"}
{
"id": 4471,
"org": 210,
"query": "acme.com",
"status": "pending",
"total_results": 0,
"total_matched_records": 0,
"created_at": "2026-07-06T09:14:02Z",
"updated_at": "2026-07-06T09:14:02Z"
}
```
Fetch the task with [`stealer_logs_search_task`](https://client-api.leak.center/scalar-docs/#tag/leaks/GET/api/service/stealer_logs_search_task/\{task_id}/), passing the `id` as the `task_id` path segment, until `status` reads `ready`.
```bash theme={"dark"}
curl "https://client-api.leak.center/api/service/stealer_logs_search_task/4471/" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```
Status moves `pending` → `in_progress` → `ready`. Two other values can come back:
* **`incomplete_ready`** — usable results are available, but from a partial run. Read them the same way; the counts tell you how much landed.
* **`failed`** — the search couldn't complete. Submit it again.
The task carries two counts as it fills in: `total_matched_records` is how many raw stealer-log records matched your query, and `total_results` is how many result entries are ready to read.
[`stealer_logs_search_results`](https://client-api.leak.center/scalar-docs/#tag/leaks/GET/api/service/stealer_logs_search_results/) returns the page of records. The parameter is **`search_id`** — the same value as the task `id` from step 1 (the name differs; the number doesn't).
```bash theme={"dark"}
curl "https://client-api.leak.center/api/service/stealer_logs_search_results/?search_id=4471&size=100" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```
The envelope paginates with `page` and `size` (default 100, max 1000). Mind the nesting: the outer object is `{count, next, previous, results}`, and `results` is itself an object — `{status, results: [...]}`. The records you want sit at **`results.results`**.
```json theme={"dark"}
{
"count": 2,
"next": null,
"previous": null,
"results": {
"status": "ready",
"results": [
{
"item_id": "e7b1c0a4-8d2f-4a91-b3c7-1f9a2e5d6b40",
"leak_id": "5a2d9f13-77c0-3e88-9b21-c4e0a1f2d3b8",
"leak_name": "Redline stealer cloud 06.2026",
"leak_source": "darknet",
"file_name": "AU-9F2C8A/passwords.txt",
"file_extension": "txt",
"leak_publish_date": "2026-06-12",
"leak_discover_date": "2026-06-14",
"item_created_at": "2026-06-14 08:21:03",
"leak_size": 74213,
"leak_tags": "stealer,password,cookie,autofill,system",
"cvss_score": 9.0,
"content": "URL: https://vpn.acme.com/\nUSER: m.garcia@acme.com\nPASS: Autumn2026!\n\nURL: https://mail.acme.com/owa\nUSER: m.garcia@acme.com\nPASS: Autumn2026!",
"botid_url": "https://storage.leak.center/stealer/9f2c8a4b1d/bot.json",
"stealer_pics_urls": [
"https://storage.leak.center/stealer/9f2c8a4b1d/screenshot.jpg"
]
}
]
}
}
```
### What each record gives you
A record describes one stealer-log capture and, most importantly, points you to the full data behind it.
* **`content`** — the slice of the capture that matched your query. Here that's a saved-password block: two internal Acme services logged in from the same infected machine, both with the same reused password. This is a preview, not the whole log.
* **`botid_url`** — a URL to the **full bot record** for that machine: the complete JSON the stealer exfiltrated. This is where the real data is.
* **`stealer_pics_urls`** — URLs to the **screenshots** the stealer captured, usually the desktop at infection time. Often the fastest way to identify whose machine it was and what they had open.
* **`leak_name`, `leak_source`, `file_name`, `leak_size`, `leak_tags`, `cvss_score`** — the source and shape of the leak it came from. `leak_tags` like `stealer,cookie,autofill,system` tell you what classes of data the capture holds.
* **`leak_publish_date`, `leak_discover_date`, `item_created_at`** — when the log surfaced, when DarknetSearch found it, and when this record was indexed.
* **`item_id`, `leak_id`** — stable identifiers for the record and its parent leak.
### Pull the capture
This is the step that makes stealer logs different: **the record is an index entry, not the payload.** The actual stealer data lives behind `botid_url` and `stealer_pics_urls`, and you fetch each one yourself.
**The bot record.** `GET` the `botid_url` exactly as the record returned it to pull the full JSON for that machine — everything the stealer took, not just the block that matched. Depending on the stealer family and what the machine held, a bot record typically covers the host and system fingerprint, every browser-saved credential, cookies (including live session tokens), autofill and saved form data, and sometimes crypto-wallet or application data.
```bash theme={"dark"}
# the botid_url from the record above
curl -L "https://storage.leak.center/stealer/9f2c8a4b1d/bot.json"
```
**The screenshots.** Fetch each entry in `stealer_pics_urls` the same way to retrieve the image.
```bash theme={"dark"}
curl -L "https://storage.leak.center/stealer/9f2c8a4b1d/screenshot.jpg" -o screenshot.jpg
```
**Fetch what you need while the search is fresh, and treat it as sensitive.** These URLs point to hosted captures on separate storage — pull the bot records and screenshots you intend to act on rather than assuming a link will resolve indefinitely. Fetch each one as the record hands it to you: some are pre-authorized links, others may want your bearer token — the live response is the source of truth for the exact shape of the bot JSON and how each link authenticates. And a bot record is raw stolen data about a real person's machine — handle and store it accordingly.
### Export the results
Two ways to get the full set out of the API — page the records yourself, or have the export system build you a file.
**Page through the results.** The results call *is* the export — raise `size` to its maximum of 1000 and follow the envelope's `next` link until it's `null`. Every page carries the same records, `botid_url` and `stealer_pics_urls` included, so you can collect the whole set and then fetch the captures you want.
```bash theme={"dark"}
curl "https://client-api.leak.center/api/service/stealer_logs_search_results/?search_id=4471&size=1000&page=1" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```
**Build a downloadable file.** For a single file instead of pages, hand the search to the platform's [export service](/api/guides/export-service). Stealer logs is a registered export service — and it exports the *resolved captures*, paging the detail records for you server-side, so the file holds the full records rather than the index rows. It's an async job: find the service, create the export, poll, download.
Export services have no fixed id — each environment assigns one when its catalog is seeded, so you look it up at request time rather than hard-coding it. [`list_export_services`](https://client-api.leak.center/scalar-docs/#tag/export/GET/api/service/list_export_services/) returns the catalog; every entry carries an `id` alongside its stable identifiers and config. Match the stealer-logs entry by its `name`, `StealerLogs`:
```json theme={"dark"}
{
"name": "StealerLogs",
"alias": "stealer_logs",
"slug": "stealer-logs",
"is_active": true,
"allowed_types": ["json", "csv", "xlsx"],
"args": {
"params": [
{ "name": "search_id", "type": "Int", "required": true, "description": "Stealer log search id to enrich and export" }
]
}
}
```
Read the `id` off that entry for the next call. `allowed_types` are the file formats you can ask for, and `args` spells out what to pass — here, a required `search_id`.
[`create_export`](https://client-api.leak.center/scalar-docs/#tag/export/POST/api/service/create_export/) takes that `service` id, a `type` from `allowed_types` (`json`, `csv`, or `xlsx`), and `args` holding the `search_id` of a finished search — the same id you read results by. It returns an export `id` and a `status`.
```bash theme={"dark"}
curl https://client-api.leak.center/api/service/create_export/ \
-X POST \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{"service": SERVICE_ID, "type": "csv", "args": {"search_id": 4471}}'
```
Fetch the job with [`get_export`](https://client-api.leak.center/scalar-docs/#tag/export/GET/api/service/get_export/) by `id` until `status` is `COMPLETE`. It moves `IN_PROGRESS` → `COMPLETE`, or `FAILED`.
[`download_export`](https://client-api.leak.center/scalar-docs/#tag/export/GET/api/service/download_export/) by `id` returns the file once the job is `COMPLETE`.
[`list_exports`](https://client-api.leak.center/scalar-docs/#tag/export/GET/api/service/list_exports/) lists your export jobs, filterable by status, type, service, and date.
### List past searches
[`stealer_logs_search_tasks`](https://client-api.leak.center/scalar-docs/#tag/leaks/GET/api/service/stealer_logs_search_tasks/) returns the searches your organization has run, most recent first, paginated with `page` and `size`. Use it to pick a `search_id` back up without re-running the search.
```bash theme={"dark"}
curl "https://client-api.leak.center/api/service/stealer_logs_search_tasks/?size=20" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```
### When to reach for it
Use stealer logs when the **machine** is the unit you care about — you want the whole capture from an infected device, the screenshots, and the full list of what was on it. When you only need the credentials themselves, the other three approaches are faster: look one identity up in the [ULP feed](/api/guides/credentials-ulp-feed), track your owned domains with [Filtered credentials](/api/guides/credentials-filtered), or read the raw dump with [Raw Data](/api/guides/credentials-raw-sweep). Start from [Find leaked credentials](/api/guides/credential-exposure) if you're deciding between them.