Filters

Filters are field:value clauses inside the q parameter. Combine them freely with free-text terms and boolean operators - see Query Syntax.

Site & network

Filter	Example	Meaning
site.domain:	site.domain:example.onion	Posts from a domain
site.type:	site.type:chat	Type of the source site
site.country:	site.country:US	Site country
site.category:	site.category:*	Category of the site
extended.network:	extended.network:telegram	Source network: telegram, openweb, tor, public_chat, discord
extended.file_type:	extended.file_type:html	Type of the crawled file

Content

Filter	Example	Meaning
title:	title:ransomware	Term in the post title
text:	text:"initial access"	Term in the post body
author:	author:admin	Post author
language:	language:english	Post language (full name, case-insensitive)
published:	published:>1751630400000	Publish time (Unix milliseconds)
crawled:	crawled:>1751630400000	Crawl time (Unix milliseconds)
is_first:	is_first:true	Only the first post of each thread

Thread

Bare forms are accepted - replies_count:>10 is read as thread.replies_count:>10.

Filter	Example	Meaning
thread.site_section:	thread.site_section:markets	Section of the site
thread.section_title:	thread.section_title:carding	Title of the section
thread.replies_count:	thread.replies_count:>10	Replies in the thread
thread.participants_count:	thread.participants_count:>5	Distinct participants
thread.spam_score:	thread.spam_score:<0.5	Spam score of the thread

Enriched entities

Entity value fields hold what was extracted from the post.

Filter	Example
enriched.category:	enriched.category:* (any classified post)
enriched.person.value:	enriched.person.value:"john doe"
enriched.organization.value:	enriched.organization.value:binance
enriched.location.value:	enriched.location.value:paris
enriched.email.value:	enriched.email.value:[email protected]
enriched.domain.value:	enriched.domain.value:example.com
enriched.phone.value:	enriched.phone.value:15551234567
enriched.credit_card.value:	enriched.credit_card.value:411111*
enriched.ssn.value:	enriched.ssn.value:*
enriched.wallet_id.value:	enriched.wallet_id.value:bc1q*
enriched.cve.value:	enriched.cve.value:"CVE-2024-3400"
enriched.cyber_risk.value:	enriched.cyber_risk.value:>7 (also .site_risk, .content_risk)

Links & files

Filter	Meaning
extended.external_link:	Links found in the post
extended.external_image:	Image links found in the post
extended.external_video:	Video links found in the post
extended.file_link:	File links found in the post

Filter with URL parameters

Any filter can also be sent as its own query parameter for exact matching (&language=english), or negated with an exclude_ prefix (&exclude_site.type=chat). Values sent this way must match exactly - ranges and wildcards belong in q.