Skip to main content
Get a breakdown of victim counts and total records per stealer malware family (RedLine, Raccoon, LummaC2, etc.). Use to power a “top malware families” chart or to prioritize which families to monitor closely.

​
Request

GET /v1/stats/families · Required scope: none — any valid key · Not paginated Response is not tier-masked and is cached for 15 minutes.

​
Example request

curl -X GET https://api.vantaprism.me/v1/stats/families \
  -H "api-key: $VANTAPRISM_API_KEY"

​
Response

200 OK — array of StatsFamilyEntry. 
{
  "data": [
    { "stealer_family": "LummaC2", "victims": 52481033, "total_records": 218904112 },
    { "stealer_family": "RedLine", "victims": 41208441, "total_records": 176302998 },
    { "stealer_family": "Raccoon", "victims": 28104772, "total_records": 98421005 },
    { "stealer_family": "Vidar", "victims": 19883201, "total_records": 71204883 }
  ],
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 6.8,
    "tier": "free",
    "masked_fields": []
  }
}
FieldDescription
stealer_familyMalware family name
victimsNumber of distinct victims attributed to this family
total_recordsTotal records (credentials, cookies, etc.) attributed to this family

​
Not paginated

This endpoint returns the full breakdown in a single response — cursor/limit/sort_direction do not apply.

​
Errors

See Errors for the full catalog. Only the standard auth and rate-limit errors apply — there is no endpoint-specific validation.

​
Tier notes

This endpoint is not tier-masked — all tiers receive identical values. Responses are cached for 15 minutes.