Search Operators
Common Searches & Search Operators for DarkOwl Vision UI
Keywords Plus Tokenized Entities
| Names or Emails in the same search | "first last"~2 OR email:(first.last@email.com OR first@email.com) |
| Multiple PII values | email:first.last@email.com OR ccn:1111111111111111 OR "first last" |
Credentials and Emails
| One (or more) Specific Email Address(es) |
email:josh@company.com email:(josh@company.com OR damian@company.com) |
| All Email Addresses from one Domain or one Subdomain |
email:company.com email:subdomain.company.com |
| All Email Addresses from one Domain, including all Subdomains | email.domain:company.com |
Other Entities
| All credit cards in a BIN | ccn:407110* |
| Specific credit card number | ccn:(1111222233334444 OR 2222333344445555) |
| IP address or CIDR range | ipAddress:192.168.0.0\/24 |
| Any Bitcoin wallet |
cryptocurrency:bitcoin Supported types: ethereum, monero, dash, z-cash, litecoin |
| Any Monero or Ethereum wallets | cryptocurrency:(monero OR ethereum) |
Data Leaks or Breaches
| Filter to a specific data leak | leak:LinkedIn |
| Exclude leak results, or results from a specific data leak | -leak:any -leak:BreachCompilation |
Data Networks
|
Only see results from a particular data network |
network:onion |
Passports
|
U.S. or U.K. passports |
/[0-9]{8,9}/ AND passport |
|
India or Australian passports |
/[A-Z]{1}[0-9]{7}/ AND passport |
|
Canadian passports |
/[A-Z]{2}[0-9]{7}/ AND passport |
Dates
|
Filter to a specific date range |
crawlDate:[2020-02-05T00:00:00Z TO 2020-02-12T00:00:00Z] |
Searching in Metadata Fields
|
Look for a keyword appearing in the title of a page |
title:market |
|
Look for a keyword or characters appearing in a URL of a page |
inUrl:hack |
|
Find a particular content type |
contentType:pdf |
|
Find content from a particular server |
headers.server:nginx |