Bot

The bot event represents a compromised device (a “bot”) listed for sale on a dark-web marketplace (for example, “Russian Market”), where attackers sell access to machines infected by information stealer malware. Each document corresponds to a single infected device, with the victim’s environment (OS, ISP, location) and the listing details describing where the bot is offered and its price.

Bot

{
    "event_type": "bot",
    "data": {
        "name": "Hacker Market - Bots",
        "url": "https://bot.market.com/market/bot/1234",
        "actor": {
            "id": "A1B2C3"
        },
        "victim_information": {
            "country_code": "CA",
            "location": "City, Country",
            "isp": "Internet Service Provider",
            "installed_at": "2026-07-22T00:00:00",
            "os": "Windows 7"
        },
        "price": "19.99",
        "currency": "usd"
    },
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    }
}

Blog Post

Bucket

⌘I

Events

Events V2 (Beta)