---
title: "Infection Analysis (NEW)"
method: POST
path: "/search-by-stealer/infection-analysis"
tags: ["Investigations"]
---

# Infection Analysis (NEW)

`POST /search-by-stealer/infection-analysis`

## Request

- Base URL: `https://api.hudsonrock.com/json/v3`
- URL: `https://api.hudsonrock.com/json/v3/search-by-stealer/infection-analysis`
- Auth: API key in header `api-key`
- TypeScript: <https://skmtc.dev/hudsonrock/apis/cavalier-api/docs/search-by-stealer/infection-analysis/post.ts> (a function with typed inputs; its response is checked against the schema)

Get infection analysis for a stealer. This endpoint analyzes browser history to identify the likely infection source and infection flow. Currently only supported for stealers where we collect and store browsing history (mainly Lumma).

## Request body

- object
  - `stealer` string: Stealer ID to get infection analysis for. Currently only supports stealers where we collect browsing history (mainly Lumma stealer)

## Response `200`

Successful operation

- object
  - `data` object
    - `likely_infection_url` string: URL identified as the most likely infection source
    - `infection_confidence` number, float: Confidence score for the infection analysis (0-1)
    - `infection_reasoning` string: Explanation of why the URL was identified as the infection source
    - `infection_flow` object[]: Chronological sequence of URLs visited that led to the infection
      - `timestamp` string, date-time: Timestamp of the infection event
      - `url` string: URL visited during the infection flow
      - `notes` string: Analysis notes about this specific URL in the infection chain
    - `analyst_summary` string: Concise summary of the infection analysis

## Other responses

- `400`: Validation error - the request or request body was invalid
- `401`: Unauthorized - the server could not authenticate the request
- `403`: Forbidden - the server authenticated the request but refuses to process it because of insufficient permissions
- `404`: Not found - the server could not find the requested resource
- `408`: Timeout - the server timed out while waiting for a response (90 seconds)
- `429`: Rate limit exceeded - the server has received too many requests in a short period of time
- `500`: Internal server error - the server encountered an unexpected condition that prevented it from fulfilling the request

---

[API](https://skmtc.dev/hudsonrock/apis/cavalier-api.md) - [All operations](https://skmtc.dev/hudsonrock/apis/cavalier-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hudsonrock/apis/cavalier-api/revisions/a7ebb4dfd47f?raw)