Each element of the cyberDocs array is one post from the deep or dark web, with its source site, thread, and enrichments nested as objects.
A complete cyber post as the API returns it (all values anonymized):
{
"url": "https://t.me/combo_market_chat#e460f13fe13f165326d8ab599725515a",
"uuid": "cfe5ea0aa2e06ad01fed82efd3734462a2b20000",
"parent_uuid": "adeccf0b36b520bef5da8d653ba4ccc8dc080000",
"title": "combo_market_chat",
"text": "[{\"date\": \"2026-04-28T07:25:52+00:00\", \"text\": \"Selling fresh combo list acme.com - 15k lines, emails + passwords, escrow accepted ...\"}]",
"highlightText": "",
"highlightTitle": "",
"author": [
"darkseller01",
"cryptok1ng"
],
"author_extended": [
{
"display_name": "darkseller01",
"user_id": "7000000001",
"adversary_group": null,
"user_link": "https://t.me/darkseller01"
},
{
"display_name": "cryptok1ng",
"user_id": "7000000002",
"adversary_group": null,
"user_link": null
}
],
"language": "english",
"referring_url": null,
"referring_file_type": null,
"rating": null,
"published": "2026-04-28T10:25:00.000+03:00",
"site": {
"name": "combo_market_chat",
"is_live": true,
"domain": "t.me",
"current_domain": "t.me",
"type": "chat",
"country": null,
"categories": [
"group"
]
},
"thread": {
"url": "https://t.me/combo_market_chat",
"uuid": "adeccf0b36b520bef5da8d653ba4ccc8dc080000",
"title": "combo_market_chat",
"full_title": "combo_market_chat",
"published": "2026-04-28T10:25:00.000+03:00",
"site_section": null,
"section_title": null,
"replies_count": 0,
"participants_count": 2,
"spam_score": 0,
"main_image": null
},
"ord_in_thread": null,
"extended": {
"external_links": [
"https://t.me/combo_lists_daily"
],
"external_images": [],
"external_videos": [],
"file_links": [],
"file_type": null,
"network": "telegram",
"required_login": false
},
"enriched": {
"categories": [
"carding"
],
"persons": null,
"organizations": null,
"locations": null,
"emails": {
"value": [
"[email protected]",
"[email protected]"
],
"count": 2
},
"phones": {
"value": [
"+15550100"
],
"count": 1
},
"credit_cards": null,
"ssns": null,
"wallet_ids": null,
"ips": null,
"domains": {
"value": [
"acme.com",
"t.me"
],
"count": 2
},
"cve": null,
"cyber_risk": {
"value": 6,
"site_risk": 6,
"content_risk": 6
}
},
"crawled": "2026-04-28T10:26:27.024+03:00",
"updated": "2026-04-28T10:26:27.024+03:00",
"cache_link": null
}| Field | Type | Description |
|---|---|---|
uuid | string | Unique id of the post |
url | string | URL of the post |
parent_uuid | string | Id of the parent post in the thread |
title | string | Post title |
text | string | Full extracted text |
author | array | Author names |
author_extended | array | Author details - see below |
language | string | Post language |
published | string | Publication time, ISO 8601 |
ord_in_thread | integer | Position in the thread |
rating | number | Rating, when the source provides one |
referring_url | string | URL that led the crawler to this post |
referring_file_type | string | File type of the referring resource |
crawled | string | When the post was crawled |
updated | string | When the post was last updated |
cache_link | string | Ready-made /dark-cache URL of the cached page, or null - see Dark Cache & Images |
highlightText / highlightTitle | string | Matched fragments, only with highlight=true |
author_extended| Field | Description |
|---|---|
display_name | Author display name |
user_id | Author id on the source site |
user_link | Author profile URL |
adversary_group | Known adversary groups associated with the author |
site| Field | Type | Description |
|---|---|---|
name | string | Site name |
domain | string | Site domain |
current_domain | string | Current domain, when the site has moved |
is_live | boolean | Site was live at last check |
type | string | Type of the site |
country | string | Site country |
categories | array | Categories of the site |
thread| Field | Type | Description |
|---|---|---|
uuid, url | string | Thread id and URL |
title, full_title | string | Thread title |
published | string | Thread publication time |
site_section, section_title | string | Site section and its title |
replies_count | integer | Replies in the thread |
participants_count | integer | Distinct participants |
spam_score | number | Spam score of the thread |
main_image | string | Main image URL |
extended| Field | Type | Description |
|---|---|---|
network | string | Source network, e.g. tor, telegram, openweb |
external_links | array | Links found in the post |
external_images | array | Images found in the post - each has url (a ready-made /cyber-image link), uuid, and text extracted from the image |
external_videos | array | Video links found in the post |
file_links | array | File links found in the post |
file_type | string | Type of the crawled file |
required_login | boolean | Source required a login |
enrichedEntities extracted from the post. Each entity object has a value array and a count.
| Field | Description |
|---|---|
categories | Content classification of the post |
persons, organizations, locations | Named entities mentioned |
emails, phones, ips, domains | Contact and infrastructure entities |
credit_cards, ssns | Financial and identity entities |
wallet_ids | Crypto wallets - an ids array of { "type", "value" } plus count |
cve | CVE identifiers |
cyber_risk | Risk scores: value (overall), site_risk, content_risk |