Use Dark Web search terms to define the Dark Web findings of interest.

A search term consists of:

  • Entity (optional): specific type of information to consider in a post or data dump.
  • Category (optional): specific types of posts to include.
  • Value (required): the text to search for.


To find:

  • the credit card number 1111 2222 3333 4444
  • only in posts containing breach data for sale
  • and exclude those same digits found as personnel numbers

Enter this:

Entity: Credit Card Number

Category: Breach Data for Sale

Value: 1111 2222 3333 4444

Entity Guidelines

Entities restrict matches to properly-formatted information types. For example, if you select the Email-Domain entity, your search will eliminate matches that don't occur in a properly-formatted email address.

  • Email ID: Match the email ID ( listed in the Value.
  • Email-Domain: Match the email domain ( listed in the Value.
  • Credit Card: Match the complete credit card number or BIN number listed in the Value.
  • IP Address: Match the single IP address (e.g., or a subnet in CIDR notation (e.g.,\/24) listed in the Value.
  • Crypto Address: Match the type of crypto wallet listed in the Value.  Valid values are bitcoin, ethereum, litecoin, monero, dash, z-cash.
  • SSN: Match the US Social Security number listed in the Value.
  • Use Any unless you have an exact ID, domain, address, or number to search for.

Available Categories

  • Breach Data for Sale: Breaches and data leaks posted on the Dark Web.
  • Executive Monitoring: Dark Web posts with references to executives of a company listed in the Value.
  • Hacker Chatter: Conversations that appear to have hostile intent related to something listed in the Value.
  • IP Leak Data / Phishing Kits / Malware / Ransomware for Sale: Dark Web posts offering the specified item for sale.
  • Any: All categories.

Value Guidelines

  • Enter one or more keywords.
  • To find keywords together in order, enclose them in double quotes: “Jim Smith”
  • To find documents containing both keywords, separate keywords with AND: drugs AND crime.
  • To find documents containing either keyword, separate keywords with OR: drugs OR crime.
  • Use parentheses if necessary to create a list of options: Bolster AND (hack OR ddos OR 0day).
  • AND and OR must be in all caps.

More Examples







Email Domain

posts containing [email protected]

posts containing

Hacker Chatter


hacker posts containing [email protected] and/or

breach data for sale containing [email protected] and/or OR

Phishing Kits


phishing kit posts containing either or

hacker chatter containing or AND

Phishing Kits


phishing kit posts containing both and

phishing kit posts containing only