# Introduction

The Leaked Cookies API returns browser cookies stolen from employee devices by infostealer malware, matched to your domain and enriched with device and source context. A leaked session cookie lets an attacker skip the login page entirely - even with a strong password and MFA.

## Coverage

Infostealer malware copies the browser profile of an infected machine - saved logins and every cookie in it. When those logs are traded or leaked, Webz.io collects them, extracts the cookies, and matches them to the domains you monitor.

Each record is one cookie: its name, value, the host it belongs to, the browser it was taken from, when it expires, and the machine it came from.

## Enrichment

Every record is enriched at collection time:

- **Cookie** - name, value, type (`AUTH`, `SESSION`, `REFRESH`, `UNCLASSIFIED`), browser, and expiration time.
- **Service** - the host and path the cookie is valid for, and whether it covers subdomains.
- **Employee** - the account email(s) found in the same infostealer log, so you know who is compromised.
- **Device** - infection id, IP, location, operating system, malware family, and more.

## How it works

1. Send a `GET` request with the `domain` you want to check - see [Quickstart](leaked-cookies-quickstart).
2. Read the matching records from the JSON response.
3. Follow the `next` URL to page through the rest - see [Pagination](leaked-cookies-pagination).

## Monitoring status

The first time you query a domain, Webz.io starts monitoring it. Until the initial scan finishes, responses carry `"domainStatus": "pending"` and may be empty or partial. Once it reads `"active"`, the initial scan is complete - new records keep arriving as they are discovered, so query again over time.

> [!NOTE]
> A leaked session or auth cookie is a live credential. Treat every `active` record as an open session to revoke.