The q parameter accepts a boolean query. Terms without a field prefix are matched against the post title, text, and thread title - plus text extracted from images and key entity fields, so a bare email address, domain, or CVE id just works.
title, text, thread.title, image_text, enriched.domain.value, enriched.email.value, enriched.phone.value, enriched.wallet_id.value, enriched.cve.value, extended.external_link
| Syntax | Example | Matches |
|---|---|---|
| Implicit AND | bitcoin wallet | Posts with both terms |
OR | bitcoin OR "crypto wallet" | Either term |
NOT or - | bitcoin NOT price, bitcoin -price | First term without the second |
( ) | (leak OR dump) bitcoin | Grouping |
"..." | "bitcoin wallet" | Exact phrase |
* | crypt* | Prefix wildcard |
$ | bitcoin$ | Exact term, no stemming. Supported for Arabic, Russian, Spanish, Chinese, Japanese, and Korean. |
field:value | extended.network:tor | Field filter - see Filters |
Bitcoin wallet mentions on Telegram channels:
"bitcoin wallet" extended.network:telegram
Crypto exchange mentions in posts that contain extracted emails - a leaked-credentials signal:
"crypto exchange" enriched.email.value:*
AND, OR, NOT must be uppercase.400 - see Errors, Rate Limits & Credits.Not sure about a query? Add warning=true to your request - potential issues come back in a warnings array without failing the request.