# Record Data Fields

Each element of the `records` array is one compromised account, with breach, device, service, and source context nested as objects.

```json
{
  "uuid": "0a1b2c3d4e5f60718293a4b5c6d7e8f901234567",
  "crawled_date": "2025-05-01T10:20:30",
  "type": "infostealer",
  "sub_type": "stealer_logs",
  "login_url": "https://portal.example.com/login",
  "login_domain": "example.com",
  "account_info": { "email": "jane@example.com", "account_name": "jane", "password": "pa****23", "password_type": "plaintext" },
  "device_info": { "ip_address": "203.0.113.10", "os": "Windows 10", "malware_family": "redline", "location": { "country": "US", "city": "Austin", "zip_code": "73301" } },
  "breach_info": { "uuid": "...", "breach_date": "2025-04-01", "breach_name": "Example Leak", "breach_domain": "example.com", "compromised_assets": ["emails", "passwords"] },
  "service_classifications": [ { "service_category": "VPN", "service_name": "Fortinet" } ],
  "publication_source_info": { "site_domain": "example-forum.onion", "is_premium": false, "published_date": "2025-04-15" }
}
```

## Record

| Field | Type | Description |
| --- | --- | --- |
| `uuid` | string | Unique id of the record (40-char hex). |
| `crawled_date` | string | When Webz.io collected the record. |
| `type` | string | `infostealer` or `data_breach`. |
| `sub_type` | string | Finer source type. |
| `login_url` | string | URL where the credential was used. |
| `login_domain` | string | Domain of the login URL. |

## `account_info`

| Field | Description |
| --- | --- |
| `email` | Compromised email address. |
| `account_name` | Account name / username. |
| `password` | Password. Masked (e.g. `pa****23`) unless your account has the view-password permission. |
| `password_type` | Password type, e.g. `plaintext`. |

## `device_info` (infostealer records)

| Field | Description |
| --- | --- |
| `infection_uuid` | Id of the infection. |
| `exfiltration_date` | When data was exfiltrated. |
| `log_file_name` | Source log file. |
| `hwid` | Device hardware id. |
| `ip_address` | Device IP address. |
| `location` | `country`, `city`, `zip_code`. |
| `computer_username` | Username on the infected machine. |
| `os` | Operating system. |
| `antivirus_software` | Detected antivirus. |
| `malware_family` | Malware family. |
| `malware_path` | Path of the malware on the device. |

## `breach_info`

| Field | Description |
| --- | --- |
| `uuid` | Breach id. Use it as `breach_uuid` to fetch the whole breach. |
| `breach_date` | When the breach occurred. |
| `breach_name` | Name of the breach. |
| `breach_domain` | Domain of the breached service. |
| `compromised_assets` | Asset types exposed in the breach. |

## `service_classifications`

A set of `{ service_category, service_name }` derived from analyzing the login URL. A record may carry more than one.

## `publication_source_info`

| Field | Description |
| --- | --- |
| `file_name`, `file_link` | Source file name and link (when your plan includes file info). |
| `post_url` | URL of the source post. Omitted when the source domain is `t.me`. |
| `site_domain` | Domain where the data was found. |
| `is_premium` | Whether the source is premium. |
| `published_date` | When the source published the data. |