Query Builders

Query Builders help you format commonly searched items that either require special formatting or work best when submitted with variations, in order to make the most inclusive search to find the best results.  Once you’ve selected the type of builder and input text in the appropriate field(s), you can either Add to Search, or Set Up Monitors. Clicking Add to Search will format the query and place it in the search bar.  You can continue to add filters, date ranges, or other advanced options before submitting the search. 

Alternate Email: When searching for email addresses a threat actor may be using with another provider, a trailing wildcard can be a helpful search. For example, entering the prefix of Conti44 in the Query Builder will finds results for conti44[at]hotmail.com, conti44[at]hotmail.il, conti44[at]tutonota.com, and so forth. These may be potential associated or alternate email addresses.

Name: When searching for first and last names, we recommend using a proximity search, with up to 2 words as a distance. This can help find variations such as “last, first” or “first middle last” (even when the middle name is unknown).

Company: When searching for company mentions on the darknet, we recommend using both the company’s name and domain in the same query. This query builder will construct a search to find results that have your company’s name or any mentions of its domain (as a Website Mention or email domain).

US Phone Numbers: When searching for US phone numbers, we recommend preparing a query without spaces and with spaces between number groups.

Set Up Monitors

Clicking Set Up Monitors (from Query Builders or Entity Search Blocks) will prompt you to select pre-built searches that will automatically save and start monitoring, notifying you when new results are found. Choose the searches you’d like to create and click Confirm.