# Record Data Fields

Each element of the `records` array is one leaked cookie, with device and source context nested as objects.

```json
{
  "uuid": "e9214d4b-55b1-692e-456f-e1fec1bc2c13",
  "domain": "example.com",
  "infected_emails": ["jane@example.com"],
  "crawled_date": "2026-09-06T01:51:29Z",
  "service_host": "portal.example.com",
  "url_path": "/",
  "is_https": true,
  "is_subdomains": true,
  "is_specific_path": false,
  "cookie_name": "sessionid",
  "cookie_value": "CM****************Aw",
  "cookie_type": "SESSION",
  "browser": "CHROME",
  "expiration_time": "2027-01-18T19:09:56Z",
  "device_info": { "infection_uuid": "63911c30...", "ip_address": "203.0.113.10", "os": "Windows 10", "malware_family": "lumma", "location": { "country": "US", "city": "Austin" } },
  "publication_source_info": { "site_domain": "t.me", "is_premium": false, "published_date": "2026-09-05" }
}
```

## Record

| Field | Type | Description |
| --- | --- | --- |
| `uuid` | string | Unique id of the record. |
| `domain` | string | The monitored domain this cookie was matched to - the `domain` you queried. |
| `infected_emails` | array | Employee account email(s) found in the same infostealer log. |
| `crawled_date` | string | When Webz.io collected the record. |

## Cookie

| Field | Type | Description |
| --- | --- | --- |
| `cookie_name` | string | Cookie name as set by the service. |
| `cookie_value` | string | Cookie value. Masked (e.g. `CM****Aw`) unless your account has the view-password permission. |
| `cookie_type` | string | `AUTH`, `SESSION`, `REFRESH`, or `UNCLASSIFIED`. |
| `browser` | string | `CHROME`, `EDGE`, `OPERA`, `FIREFOX`, `SAFARI`, or `UNKNOWN`. |
| `expiration_time` | string | When the cookie expires. Absent for session-only cookies. |

## Service

| Field | Type | Description |
| --- | --- | --- |
| `service_host` | string | Host the cookie is valid for. |
| `url_path` | string | Path the cookie is scoped to. |
| `is_https` | boolean | Cookie is sent over HTTPS only. |
| `is_subdomains` | boolean | Cookie is also valid for subdomains of `service_host`. |
| `is_specific_path` | boolean | Cookie is limited to `url_path`. |

## `device_info`

The infected machine the cookie was taken from.

| Field | Description |
| --- | --- |
| `infection_uuid` | Id of the infection. Records from the same machine share it - across cookies, secrets, and Data Breaches API credentials. |
| `exfiltration_date` | When the data was exfiltrated from the device. |
| `log_file_name` | Source log file. |
| `hwid` | Device hardware id. |
| `ip_address` | Device IP address. |
| `location` | `country`, `city`, `zip_code`. |
| `computer_username` | Username on the infected machine. |
| `os` | Operating system. |
| `antivirus_software` | Detected antivirus. |
| `malware_family` | Malware family. |
| `malware_path` | Path of the malware on the device. |

## `publication_source_info`

| Field | Description |
| --- | --- |
| `file_name`, `file_link` | Source file name and link (when your plan includes file info). |
| `site_domain` | Domain where the data was found. |
| `is_premium` | Whether the source is premium. |
| `published_date` | When the source published the data. |