Skip to main content
Search victims’ browser history for up to 10 terms, matched against visited URLs and page titles. Use for behavioral fingerprinting and cross-victim correlation — recurring rare or internal URLs appearing across many victims are strong attribution signals for a coordinated campaign or shared infrastructure.

​
Request

POST /v1/search/term · Required scope: search:stealer (all tiers)
ParameterTypeRequiredDefaultDescription
termsstring[]Yes—Search terms matched against visited URL/title, 1–10 items, e.g. ["accounts.google.com"]
start_datestring (date-time) | nullNo—Inclusive start filter, clamped by query_window_days
end_datestring (date-time) | nullNo—Inclusive end filter
sort_directionasc | descNodescMust stay constant across pages
cursorstring | nullNo—Pagination token
limitintegerNo251–500, clamped to your tier’s max_rows

​
Example request

curl -X POST https://api.vantaprism.me/v1/search/term \
  -H "api-key: $VANTAPRISM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "terms": ["accounts.google.com"], "limit": 25 }'

​
Response

200 OK — array of TermSearchResult, cursor-paginated. 
{
  "data": [
    {
      "stealer_id": "RL-2026-AC91F3",
      "victim_id": "a3f1c9e8b2d4567890abcdef1234567890abcdef1234567890abcdef123456",
      "url": "https://accounts.google.com/***",
      "domain": "google.com",
      "title": "Sign in - Google Accounts",
      "visited_at": "2026-05-01T09:14:02Z",
      "visit_count": 12,
      "ip": "203.0.x.x",
      "country": "US",
      "stealer_family": "RedLine"
    }
  ],
  "nextCursor": null,
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 31.2,
    "tier": "free",
    "masked_fields": ["url", "ip"]
  }
}
FieldDescription
stealer_idlog_victim_id of the infected machine
victim_idSHA-256 victim ID — use with Victim Profiles
urlMasked to scheme://host/*** on free tier
domainRegistrable domain extracted from url
titlePage title at time of visit
visited_atWhen the page was visited, may be null if unavailable
visit_countNumber of times the URL was visited
ipMasked via subnet_mask on free tier
countryISO 3166-1 alpha-2
stealer_family

​
Pagination

Cursor-paginated — see Pagination.

​
Errors

StatuscodeCause
400VALIDATION_ERRORterms is empty or exceeds 10 items
400INVALID_CURSORTampered or stale cursor
403FORBIDDEN_SCOPEKey lacks search:stealer
See Errors for the full catalog.

​
Tier notes

url and ip are masked per the standard free-tier rules in Data Masking. The “searched value is never masked” rule does not apply here — you searched by free-text term, not by an identifier field.