---
title: "Check an email address against infostealer malware logs"
method: POST
path: "/v1/metered/infostealer"
tags: ["Identity exposure"]
---

# Check an email address against infostealer malware logs

`POST /v1/metered/infostealer`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/infostealer`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

A single infected device exposes every saved password at once: banking, card autofill, email, SaaS, and live session cookies that bypass 2FA. This returns the infection records tied to the address, including when the device was compromised and how many corporate and personal services were on it.

**Billing.** $0.50 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

## Request body

- object
  - `email` string, email, required: Email address to check.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `observed_at` string, date-time: When this verdict was observed. Cache keyed on this, not on receipt time.
    - `valid_for_seconds` integer: How long this verdict can be cached before it should be re-checked. Flagged results live 7 days; clean results live 6 hours, because a hit stays a hit while a clean answer is the one that flips without telling whoever cached it. A degraded result lives 5 minutes. This is a caching hint and a policy default, not a measurement and not a safety guarantee: how fast a verdict really goes stale is bounded by upstream detection latency, which we do not control.
    - `expires_at` string, date-time: observed_at plus valid_for_seconds, precomputed.
    - `degraded` boolean: True when this answer was assembled from incomplete or failed upstream data. Treat it as NO VERDICT, never as clean. An outage that returns an empty finding list is otherwise indistinguishable from a real all-clear, and it fails in the permissive direction.
    - `record_type` string: Always `credential_exposure`.
    - `email` string: The normalised address that was checked.
    - `found` boolean: True when at least one infection record exists.
    - `stealer_count` integer: Number of distinct infected devices.
    - `stealers` object[]: One entry per infected device.
      - `date_compromised` string: When the device was infected.
      - `computer_name` string: Hostname recorded by the malware.
      - `operating_system` string: OS string recorded by the malware.
      - `malware_path` string: Filesystem path the stealer ran from.
      - `total_corporate_services` integer: Corporate credentials found on the device.
      - `total_user_services` integer: Personal credentials found on the device.

## Other responses

- `400`: `email` is missing or contains no '@'.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.
- `502`: Upstream infostealer corpus unavailable.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)