Search API Query Construction Cheat Sheet
Keywords and Phrases
How to search… |
q field |
Request Parameters |
|
One Term |
q=malware |
|
|
Phrases |
q="the quick brown fox" |
|
|
Names or Words in Proximity |
q="Pat Smith"~2 |
|
|
Multiple terms, AND |
q=(hack AND password) |
|
|
Combination of terms and tokenized entities |
q="Pat Smith" OR email:pat.smith@email.com OR ccn:11111111111111111 |
|
|
Phone numbers |
q="3031234567" OR "303-123-4567" |
|
|
IP addresses |
q="127.0.0.1\/24" |
|
|
Exclude words or parameters |
q=password -hack |
&domain=-pastebin.com |
Emails, Cards, SSNs
How to search… |
q field |
Request Parameters |
|
All emails from a domain, including all subdomains |
q=email.domain:company.com |
&emailDomain=company.com |
|
All emails from a domain, not including subdomains |
q=email:company.com |
&email=company.com |
|
Individual email addresses |
q=email:pat.smith@gmail.com |
&email=pat.smith@gmail.com&highlight=true |
|
Credit cards |
q=ccn:4234567890123456 |
&ccn=4234567890123456&highlight=true |
|
Social security numbers |
q=ssn:123-45-6789 |
&ssn=123-45-6789&highlight=true |
Data Leaks & Data Networks
How to search… |
q field |
Request Parameters |
|
Filter to a Domain |
q=domain:past.io |
&domain=past.io |
|
Filter to a Data Leak |
q=leak:linkedin |
&leak=linkedin |
|
Filter to TOR |
q=network:onion |
&source=onion |
Dates
How to search… |
q field |
Request Parameters |
|
Date ranges |
|
&from=2020-12-01T00:00:00Z&to=2020-12-31T00:00:00Z |
Other Filters
How to search… |
q field |
Request Parameters |
|
Results with any Hackishness |
|
&hack_min=.01 |
|
Results in a Language |
|
&language= (this link has a list of values) |
Result Options
How to search… |
q field |
Request Parameters |
|
Sort results by |
|
&sort=h (relevancy, hackishness, or date crawled) |
|
De-duplicate similar results |
|
&similar=false |
|
Return snippets |
|
&detail=snippet |
|
Highlight ‘q’ field terms |
|
&highlight=true |