Record Data Fields - Webz.io

Each element of the records array is one leaked secret, with device and source context nested as objects.

json

{
  "uuid": "7c2f1a90-3d4e-4b6a-9f21-0a8d5e6c7b31",
  "domain": "example.com",
  "infected_emails": [
    "[email protected]"
  ],
  "crawled_date": "2026-09-05T14:02:11Z",
  "token_type": "ApiKey",
  "service_type": "googlegeminiapikey",
  "matched_string": "AI****************************Xk",
  "secret_parts": {
    "key": "AI****************************Xk"
  },
  "verified": true,
  "verification_status": "verified",
  "file_metadata": {
    "file_name": ".env",
    "file_extension": "env"
  },
  "device_info": {
    "infection_uuid": "63911c30...",
    "ip_address": "203.0.113.10",
    "os": "Windows 11",
    "malware_family": "lumma",
    "location": {
      "country": "DE",
      "city": "Berlin"
    }
  },
  "publication_source_info": {
    "site_domain": "t.me",
    "is_premium": false,
    "published_date": "2026-09-04"
  }
}

Record

Field	Type	Description
`uuid`	string	Unique id of the record.
`domain`	string	The monitored domain this secret was matched to - the `domain` you queried.
`infected_emails`	array	Employee account email(s) found in the same infostealer log.
`crawled_date`	string	When Webz.io collected the record.

Secret

Field	Type	Description
`token_type`	string	Kind of credential, e.g. `ApiKey`, `OauthPAT`, `RefreshToken`, `PrivateKey`.
`service_type`	string	Detector / issuing service that matched the secret, e.g. `googleoauth2`.
`matched_string`	string	The secret as found. Masked (e.g. `AI****Xk`) unless your account has the view-password permission.
`secret_parts`	object	The secret split into its named parts (e.g. `key`, or `client_id` + `client_secret`). Masked under the same rule.
`verified`	boolean	`true` when the secret was confirmed live against its issuer.
`verification_status`	string	`verified`, `unverified`, or `unknown`.

`file_metadata`

Field	Description
`file_name`	Name of the file the secret was found in, e.g. `.env`.
`file_extension`	File extension.

`device_info`

The infected machine the secret was taken from.

Field	Description
`infection_uuid`	Id of the infection. Records from the same machine share it - across cookies, secrets, and Data Breaches API credentials.
`exfiltration_date`	When the data was exfiltrated from the device.
`log_file_name`	Source log file.
`hwid`	Device hardware id.
`ip_address`	Device IP address.
`location`	`country`, `city`, `zip_code`.
`computer_username`	Username on the infected machine.
`os`	Operating system.
`antivirus_software`	Detected antivirus.
`malware_family`	Malware family.
`malware_path`	Path of the malware on the device.

`publication_source_info`

Field	Description
`file_name`, `file_link`	Source file name and link (when your plan includes file info).
`site_domain`	Domain where the data was found.
`is_premium`	Whether the source is premium.
`published_date`	When the source published the data.