# stealerlogs

> Search stealer logs by email, username, URL, password, or IP. Hits include login, cookies, wallets, autofill, and Discord. Use the API.

Search accepts one identifier at a time: URL (`url`), Email (`email`), Email domain (`email_domain`), Username (`username`), Password (`password`), IP address (`ip`). Hits include origin, login, password, source, and post date. Opening a log shows the rest of that machine: other passwords, cookies, autofill, wallets, Discord and Telegram tokens, and system info.

Plans last 30 days. Plus and Pro reset at 00:00 UTC. Max has no search cap.

- Plus: $20/month, 200 searches / day. Light use.
- Pro: $30/month, 1,000 searches / day. Daily use.
- Max: $200/month, Unlimited searches / month. Heavy use.

The site search does not require a plan. An active plan is required for the API. Send the account key as `Authorization: Bearer <api key>`. The API allows 7 requests per second. Docs examples use the signed-in key, or `your_api_key` when nobody is signed in.

- `GET https://stealerlogs.com/api/me` returns the current plan, days left, searches used today, searches remaining, and the UTC reset time.
- `GET https://stealerlogs.com/api/search?q=&type=` searches. `type` is one of url, email, email_domain, username, password, ip. `wildcard=1` treats `q` as a wildcard, where `?` is one character and `_` is any number of characters. A backslash before either character searches for it. `files=1` hides hits with no files.
- `GET https://stealerlogs.com/api/logs/{id}/credentials?page=1` returns logins from that log, 100 per page. Page starts at 1.
- `GET https://stealerlogs.com/api/logs/{id}/cookies?page=1` returns cookies. `domains` is a comma-separated filter. `hide_expired=1` omits expired cookies.
- `GET https://stealerlogs.com/api/logs/{id}/files?page=1` lists files in the log.
- `GET https://stealerlogs.com/api/logs/{id}/content?path=` returns one file.

## Pages

- [Home](https://stealerlogs.com/): Search the index, see what a log contains, compare plans, and read the FAQ.
- [Compare](https://stealerlogs.com/compare): stealer log search next to OathNet and Intelligence X. stealerlogs has 44 billion records from 37 million machines. OathNet has 14.8 billion.
- [API documentation](https://stealerlogs.com/docs): HTTP API and the official clients.
- [About](https://stealerlogs.com/about): What the index searches and who it is for.
- [What is a stealer log](https://stealerlogs.com/stealer-logs): The dump one infected machine produces.
- [Found in a log](https://stealerlogs.com/what-to-do): Clean the device first, then change passwords.
- [Company domain](https://stealerlogs.com/domain-search): Find staff and customer addresses in the index.
- [Sources and the 10,000 limit](https://stealerlogs.com/sources): Telegram bots, and why Elasticsearch stops at 10,000.
- [Infostealer families](https://stealerlogs.com/malware): RedLine, Lumma, Vidar, Raccoon, StealC, Atomic.
- [RedLine Stealer](https://stealerlogs.com/malware/redline): For years the most common Windows stealer in circulating logs.
- [Lumma Stealer](https://stealerlogs.com/malware/lumma): Often delivered by fake verify-you-are-human pages.
- [Vidar](https://stealerlogs.com/malware/vidar): A long-running Windows stealer, often dropped with other malware.
- [Raccoon Stealer](https://stealerlogs.com/malware/raccoon): A cheap Windows stealer. Its alleged operator was arrested in 2022.
- [StealC](https://stealerlogs.com/malware/stealc): A 2023 Windows stealer that copies features from older families.
- [Atomic macOS Stealer](https://stealerlogs.com/malware/atomic): A macOS stealer. It prompts for the user password and opens the Keychain.
- [Terms of Service](https://stealerlogs.com/terms): Accounts, plans, payment, and acceptable use.
- [Privacy Policy](https://stealerlogs.com/privacy): What the site collects and how to ask about an account.

## Clients

- [Go](https://github.com/stealerlogs-com/stealerlogs-go)
- [Rust](https://github.com/stealerlogs-com/stealerlogs-rs)
- [Python](https://github.com/stealerlogs-com/stealerlogs-py)
- [TypeScript](https://github.com/stealerlogs-com/stealerlogs-ts)