Using Dark Web Search Terms

Use Dark Web search terms to define the Dark Web findings of interest.

A search term consists of:

• Entity (optional): specific type of information to consider in a post or data dump.
• Category (optional): specific types of posts to include.
• Value (required): the text to search for.

Example

To find:

• the credit card number 1111 2222 3333 4444
• only in posts containing breach data for sale
• and exclude those same digits found as personnel numbers

Enter this:

Entity: Credit Card Number

Category: Breach Data for Sale

Value: 1111 2222 3333 4444

Entity Guidelines

Entities restrict matches to properly-formatted information types. For example, if you select the Email-Domain entity, your search will eliminate matches that don’t occur in a properly-formatted email address.

• Email ID: Match the email ID (ID@domain.xxx) listed in the Value.
• Email-Domain: Match the email domain (domain.xxx) listed in the Value.
• Credit Card: Match the complete credit card number or BIN number listed in the Value.
• IP Address: Match the single IP address (e.g., 192.1.67.0.5) or a subnet in CIDR notation (e.g., 192.1.68.0.0/24) listed in the Value.
• Crypto Address: Match the type of crypto wallet listed in the Value.  Valid values are bitcoin, ethereum, litecoin, monero, dash, z-cash.
• SSN: Match the US Social Security number listed in the Value.
• Use Any unless you have an exact ID, domain, address, or number to search for.

Available Categories

• Breach Data for Sale: Breaches and data leaks posted on the Dark Web.
• Executive Monitoring: Dark Web posts with references to executives of a company listed in the Value.
• Hacker Chatter: Conversations that appear to have hostile intent related to something listed in the Value.
• IP Leak Data / Phishing Kits / Malware / Ransomware for Sale: Dark Web posts offering the specified item for sale.
• Any: All categories.

Value Guidelines

• Enter one or more keywords.
• To find keywords together in order, enclose them in double quotes: “Jim Smith”
• To find documents containing both keywords, separate keywords with AND: drugs AND crime.
• To find documents containing either keyword, separate keywords with OR: drugs OR crime.
• Use parentheses if necessary to create a list of options: Bolster AND (hack OR ddos OR 0day).
• AND and OR must be in all caps.

More Examples