Each element of the records array is one compromised account, with breach, device, service, and source context nested as objects.
json
{
"uuid": "0a1b2c3d4e5f60718293a4b5c6d7e8f901234567",
"crawled_date": "2025-05-01T10:20:30",
"type": "infostealer",
"sub_type": "stealer_logs",
"login_url": "https://portal.example.com/login",
"login_domain": "example.com",
"account_info": {
"email": "[email protected]",
"account_name": "jane",
"password": "pa****23",
"password_type": "plaintext"
},
"device_info": {
"ip_address": "203.0.113.10",
"os": "Windows 10",
"malware_family": "redline",
"location": {
"country": "US",
"city": "Austin",
"zip_code": "73301"
}
},
"breach_info": {
"uuid": "...",
"breach_date": "2025-04-01",
"breach_name": "Example Leak",
"breach_domain": "example.com",
"compromised_assets": [
"emails",
"passwords"
]
},
"service_classifications": [
{
"service_category": "VPN",
"service_name": "Fortinet"
}
],
"publication_source_info": {
"site_domain": "example-forum.onion",
"is_premium": false,
"published_date": "2025-04-15"
}
}
Record
| Field | Type | Description |
|---|
uuid | string | Unique id of the record (40-char hex). |
crawled_date | string | When Webz.io collected the record. |
type | string | infostealer or data_breach. |
sub_type | string | Finer source type. |
login_url | string | URL where the credential was used. |
login_domain | string | Domain of the login URL. |
account_info
| Field | Description |
|---|
email | Compromised email address. |
account_name | Account name / username. |
password | Password. Masked (e.g. pa****23) unless your account has the view-password permission. |
password_type | Password type, e.g. plaintext. |
device_info (infostealer records)
| Field | Description |
|---|
infection_uuid | Id of the infection. |
exfiltration_date | When data was exfiltrated. |
log_file_name | Source log file. |
hwid | Device hardware id. |
ip_address | Device IP address. |
location | country, city, zip_code. |
computer_username | Username on the infected machine. |
os | Operating system. |
antivirus_software | Detected antivirus. |
malware_family | Malware family. |
malware_path | Path of the malware on the device. |
breach_info
| Field | Description |
|---|
uuid | Breach id. Use it as breach_uuid to fetch the whole breach. |
breach_date | When the breach occurred. |
breach_name | Name of the breach. |
breach_domain | Domain of the breached service. |
compromised_assets | Asset types exposed in the breach. |
service_classifications
A set of { service_category, service_name } derived from analyzing the login URL. A record may carry more than one.
publication_source_info
| Field | Description |
|---|
file_name, file_link | Source file name and link (when your plan includes file info). |
post_url | URL of the source post. Omitted when the source domain is t.me. |
site_domain | Domain where the data was found. |
is_premium | Whether the source is premium. |
published_date | When the source published the data. |
