Each element of the records array is one leaked cookie, with device and source context nested as objects.
json
{
"uuid": "e9214d4b-55b1-692e-456f-e1fec1bc2c13",
"domain": "example.com",
"infected_emails": [
"[email protected]"
],
"crawled_date": "2026-09-06T01:51:29Z",
"service_host": "portal.example.com",
"url_path": "/",
"is_https": true,
"is_subdomains": true,
"is_specific_path": false,
"cookie_name": "sessionid",
"cookie_value": "CM****************Aw",
"cookie_type": "SESSION",
"browser": "CHROME",
"expiration_time": "2027-01-18T19:09:56Z",
"device_info": {
"infection_uuid": "63911c30...",
"ip_address": "203.0.113.10",
"os": "Windows 10",
"malware_family": "lumma",
"location": {
"country": "US",
"city": "Austin"
}
},
"publication_source_info": {
"site_domain": "t.me",
"is_premium": false,
"published_date": "2026-09-05"
}
}
Record
| Field | Type | Description |
|---|
uuid | string | Unique id of the record. |
domain | string | The monitored domain this cookie was matched to - the domain you queried. |
infected_emails | array | Employee account email(s) found in the same infostealer log. |
crawled_date | string | When Webz.io collected the record. |
Cookie
| Field | Type | Description |
|---|
cookie_name | string | Cookie name as set by the service. |
cookie_value | string | Cookie value. Masked (e.g. CM****Aw) unless your account has the view-password permission. |
cookie_type | string | AUTH, SESSION, REFRESH, or UNCLASSIFIED. |
browser | string | CHROME, EDGE, OPERA, FIREFOX, SAFARI, or UNKNOWN. |
expiration_time | string | When the cookie expires. Absent for session-only cookies. |
Service
| Field | Type | Description |
|---|
service_host | string | Host the cookie is valid for. |
url_path | string | Path the cookie is scoped to. |
is_https | boolean | Cookie is sent over HTTPS only. |
is_subdomains | boolean | Cookie is also valid for subdomains of service_host. |
is_specific_path | boolean | Cookie is limited to url_path. |
device_info
The infected machine the cookie was taken from.
| Field | Description |
|---|
infection_uuid | Id of the infection. Records from the same machine share it - across cookies, secrets, and Data Breaches API credentials. |
exfiltration_date | When the data was exfiltrated from the device. |
log_file_name | Source log file. |
hwid | Device hardware id. |
ip_address | Device IP address. |
location | country, city, zip_code. |
computer_username | Username on the infected machine. |
os | Operating system. |
antivirus_software | Detected antivirus. |
malware_family | Malware family. |
malware_path | Path of the malware on the device. |
publication_source_info
| Field | Description |
|---|
file_name, file_link | Source file name and link (when your plan includes file info). |
site_domain | Domain where the data was found. |
is_premium | Whether the source is premium. |
published_date | When the source published the data. |
