Description of Response Fields in Search API

Response fields

Field descriptions

id

The DarkOwl Vision identifier for the result.

body

The full text collected from the webpage/record/target. Note that this field will not be returned if detail=snippet or detail=nonbody is selected in the request.

snippet

Excerpt of the body, based on the first highlighted term in the body. This field will not be returned if detail=body or detail=nonbody is selected in the request, or if the request does not include a detail parameter (the detail default is body).

hackishness

Rating assigned by DarkOwl Vision, indicating the likelihood to which the information could be used for criminal activity. Assigned on a per-page basis.

title

If available, page title of the content collected.

url

URL or location of the content collected.

crawlDate

Date when DarkOwl Vision collected the content.

fileSize

The size of the content before normalization, in bytes.

domain

Domain of the content collected.

ips

A list of ip addresses found in the body, if available.

emails

A list of emails found in the body, if available.

ssns

A list of social security numbers found in the body, if available.

ccns

A list of credit card numbers found in the body, if available.

cryptos

A list of cryptocurrencies found in the body, if available.

cves

A list of Common Vulnerabilities and Exposures found in the body, if available.

headers

The httpHeader content collected with the result, if available.

leak

Leak information and metadata, if the document was sourced from a leak. May include the following fields, if available: name, actors, host, associations, downloadLocations, filepath, filename

name: The name DarkOwl assigned to the leak, which is typically based on the target, original post title or file name, or other generally-known name.

To retrieve Leak Context: Pass the value from this name field to the Leak Context endpoint.

actors: The name of the original poster or actor who made the data available, if known.

host: The site name of the location where the leak was hosted. Examples: Doxbin, BreachForums, Mega.

associations: Other categories that help classify the leak, or associate it with other leaks. Examples: Combolist, Ransomware, Twitter (if there are multiple Twitter-related breaches).

chat

Chat information and metadata, if the document was sourced from a chat network. May include the following fields, if available: users, channel, server

forum

Forum post information and metadata, if the document was sourced from a forum. Will include the following fields: threadId, postAuthor, postDate.