The Cyber API response includes up to 10 CyberDoc and a Meta Info area with reference to API consumption and the request itself, such as the "next" URL to get the next batch of CyberDocs matching your query.
Each CyberDoc is constructed of 6 objects:
The Post Object includes information about the particular post, such as URL, post text and title.
The Author Object includes information about the author who published the post, such as username, user id and user link.
The Site Object includes information about the site, channel or group the post originated from.
The Thread Object Includes Information about the thread in which the post was published, such as the title, publication date and participants count.
The Extended Object includes additional meta info from the webpage, such as network and external links.
The Enriched Object includes analyzed information about the Item, such as extracted entities and risk score.
Post Object
Main fields that appear in the CyberDoc Object:
| Field Name | Description | Searchable? | Type |
|---|---|---|---|
| url | URL of the post page | Yes. Partial search is allowed. | String |
| uuid | A unique ID representing the post or comment | Yes | String |
| parent_uuid | The unique ID of the parent document. If the post originated from structured data , it represents the thread URL. If the post is originated from unstructured data , it represents the referring URL. | Yes | String |
| title | The title of the post | Yes. Partial search is allowed. | String |
| text | The text within the post • For standard posts: This field is a string representing the textual content. • For chat data: This field is an object containing detailed information about the messages (refer to the table below for the structure). | Yes. Partial search is allowed. | String/Object |
| author | A author (username) of the post • For standard posts: This field is a string representing the username of the post's author. • For chat data: This field is an array of strings, where each string represents a username of an author who contributed to the conversation. | Yes. Partial search is allowed. | String / Array [String] |
| language | The main language detected in the post's text | Yes | String |
| referring_url | The URL that referred our crawler to the current document URL | Yes | String |
| referring_file_type | The file type of the URL that referred our crawler to the current document URL | Yes | String |
| rating | Obsolete Left for backward Compatibility. (rating is a floating number between 0.0 to 5.0.) | Yes | Float |
| published | The date/time when the post was published | Yes | Date Format: yyyy-MM-dd'T'HH:mm:ss.SSSXXX |
| ord_in_thread | The post sequence number in the context of the thread: 0 - means first post | Yes | Integer |
| crawled | The date/time when the post was crawled. | Yes | Date Format: yyyy-MM-dd'T'HH:mm:ss.SSSXXX |
| updated | The date/time when the post was updated. | No | Date Format: yyyy-MM-dd'T'HH:mm:ss.SSSXXX |
| cache_link | A link to a cached HTML snapshot of the post's page | No | String |
Text Object
When the JSON file pertains to chat data, the text field is structured as follows, with each text field containing up to 20 messages:
| Field Name | Description | Searchable | Type |
|---|---|---|---|
| date | The date and time when the message was published. | Yes. Search within the text field. | Date Format: [yyyy-MM-dd'T'HH:mm:ss.SSSXXX] |
| text | The text within the message. | Yes. Search within the text field. | String |
| user | The username of the message author. | Yes. Search within the text field. | String |
| message ID | The unique identifier of the message. • Available only on Telegram. | Yes. Search within the text field. | String |
| forwarded | A Boolean value (true/false) indicating if the message was forwarded from a different group/channel. • Available only on Telegram. | Yes. Search within the text field. | Boolean |
| forwarded_from | The group/channel from which the message was forwarded. • Available only on Telegram. | Yes. Search within the text field. | URL [String] |
| file_info.file_name | The name of a file attached to the message. • Available only on Telegram. | Yes. Search within the text field. | String |
| file_info.file_size | The size of a file attached to the message. • Available only on Telegram. | Yes. Search within the text field. | String |
| file_info.file_type | The type of file attached to the message. • Available only on Telegram. | Yes. Search within the text field. | String |
| message_link | The unique link assigned to the message. • Available only on Telegram. | Yes. Search within the text field. | URL [String] |
Author_Extended Array of Objects
auhotr_extended object allows to uniquely capture the actor identity in the website/application.
| Field Name | Description | Searchable | Type |
|---|---|---|---|
| display_name | The user visual name , displayed in the website or application next to the post. | Yes Partial search is allowed. | String |
| user_id | The unique identifier of the user in the website or application. | Yes. Partial search is allowed | String |
| user_link | The unique hyperlink to the user information in the website or application. | Yes. Partial search is allowed. | URL [String] |
Site Object
| Field Name | Description | Searchable? | Type |
|---|---|---|---|
| name | The name of the site where the post was published | Yes. Partial search is allowed | String |
| is_live | Obsolete Left for backward Compatibility. Value is always TRUE | No | Boolean |
| domain | The top level domain of the site where the post was published | Yes. Partial search is allowed | String |
| current_domain | The specific domain used at the time the post was scanned | Yes. Partial search is allowed | String |
| type | Possible site types: • news • blogs • discussions • chat • market • paste • datastore • social_media • imageboard • ransomware_blog | Yes | String |
| categories | For standard posts, the possible site categories are: • cyber_threat_intelligence • financial_crime • illicit_trafficking • extremism_misinformation • brand_monitoring For more details , please refer to this page. For Telegram data only, the possible site categories are: • group • channel | Yes | Array[String] |
Thread Object
| Field Name | Description | Searchable? | Type |
|---|---|---|---|
| url | For standard posts - A link to the thread where the post was published. For chat data - A link to the channel / group | Yes. Partial search is allowed | String |
| uuid | A unique ID representing the thread | Yes | String |
| title | The title of the thread | Yes | String |
| full_title | The title of the section in the site where the thread was created | No | String |
| published | The date/time when the thread was published. | Yes | Date Format: yyyy-MM-dd'T'HH:mm:ss.SSSXXX |
| site_section | A link to the section in the site where the thread was created | Yes. Partial search is allowed | String |
| section_title | The title of the section in the site where the thread was created | Yes. Partial search is allowed | String |
| replies_count | How many replies are there to the main post | Yes | Integer |
| participants_count | How many different people participated in the discussion | Yes | Integer |
| spam_score | Obsolete Left for backward Compatibility. | No | Float |
| main_image | A link to the main image presented in the post | No | URL [String] |
Extended Object
| Field Name | Description | Searchable? | Type |
|---|---|---|---|
| external_links | A list of external URLs that are mentioned in the post | Yes. Partial search is allowed | Array[String] |
| external_videos | A list of URLs to videos from the page | Yes. Partial search is allowed | Array[String] |
| external_images | A structure. See External Images Object in the next table. | Yes. Partial search is allowed | |
| file_links | A list of URLs to files from the page | Yes. Partial search is allowed | Array[String] |
| file_type | Possible file types: • html • zip • rar • tar • 7z • txt • xls • xlsx • doc • docx • sql | Yes | String |
| network | Dark Network that contained the page/post This could be one of the following: • tor • discord • i2P • telegram • openweb • icq | Yes | String |
| required_login | A Boolean value (true/false) stating if the content is protected by a password | Yes | Boolean |
External Images Array of Objects
| Name | Description | Searchable? | Type |
|---|---|---|---|
| url | The link to the actual image | Yes | String |
| uuid | A unique ID for the image by its content. Multiple posts could link to the same image, even if it is on different locations. | Yes | String |
| text | Textual content extracted from the image using OCR (Optical Character Recognition) | Yes | String |
Enriched Object
| Field Name | Description | Searchable? | Type |
|---|---|---|---|
| categories | One or more cyber categeries that the post/page content belong to. Categories include: • hacking • data_breach • carding • crypto • phishing • malware • ransomware • stealer_logs • counterfeit • gaming • extremism • drugs • weapons • sexual For more details , please refer to this page. | Yes | Array[String] |
| * persons | One or more individual people entities found in the post | Yes | Object |
| persons.value | Person names extracted from the post | Yes | Array[String] |
| persons.count | Number of people mentioned in the post | Yes | Integer |
| * organizations | One or more organization entities found in the post | Yes | Object |
| organizations.value | Organization names extracted from the post | Yes | Array[String] |
| organizations.count | Number of organizations mentioned in the post | Yes | Integer |
| * locations | One or more location entities found in the post | Yes | Object |
| locations.value | Location names extracted from the post | Yes | Array[String] |
| locations.count | Number of locations mentioned in the post | Yes | Integer |
| emails | One or more email address entities found in the post | Yes | Object |
| emails.value | Email addresses extracted from the post | Yes | Array[String] |
| emails.count | Number of emails mentioned in the post | Yes | Integer |
| phones | One or more phone number entities found in the post | Yes | Object |
| phones.value | Phone numbers extracted from the post | Yes | Array[String] |
| phone.count | Number of phone numbers extracted from the post | Yes | Integer |
| credit_cards | One or more credit cards entities found in the post | Yes | Object |
| credit_cards.value | Credit card numbers extracted from the post | Yes | Array[String] |
| credit_cards.count | Number of credit card numbers extracted from the post | Yes | Integer |
| ssns | One or more social security number (SSN) entities found in the post | Yes | Object |
| ssns.value | SSN numbers extracted from the post | Yes | Array[String] |
| ssns.count | Number of SSNs extracted from the post | Yes | Integer |
| wallet_ids | One or more crypto address entities found in the post | Yes | Object |
| wallet_ids.ids | Crypto addresses extracted from the post | Yes | Array of Objects |
| wallet_ids.ids.value | Crypto address value | Yes | String |
| wallet_ids.ids.type | Crypto currency type | No | String |
| wallet_ids.count | Number of crypto addresses extracted from the post | Yes | Integer |
| ips | One or more IP entities found in the post | Yes | Object |
| ips.value | IP addresses extracted from the post | Yes | Array[String] |
| ips.count | Number of IP addresses extracted from the post | Yes | Integer |
| domains | One or more domain entities found in the post | Yes | Object |
| domains.value | Domain addresses extracted from the post | Yes | Array[String] |
| domains.count | Number of domain addresses extracted from the post | Yes | Integer |
| cve | One or more CVE Ids entities found in the post/page | Yes | Object |
| cve.value | CVEs extracted from the post | Yes | Array[String] |
| cve.count | Number of CVEs extracted from the post | Yes | Integer |
| cyber_risk | Risk score assigned to the post, ranging from 0 to 10 (where 10 indicates the highest risk level) | Yes | Object |
| cyber_risk.value | The overall cyber risk score assigned to the post, considering both site and content factors | Yes | Integer |
| cyber_risk.site_risk | Risk score attributed to the website where the post was published | Yes | Integer |
| cyber_risk.content_risk | Risk score assigned to the content of post itself | Yes | Integer |
* Currently not supported in chat networks
Meta info
| Field Name | Description | Type |
|---|---|---|
| totalResults | The total number of posts matching your query | Integer |
| moreResultsAvailable | How many more results are available | Integer |
| next | A URL to get the next batch of posts matching your query. See Pagination and Sorting in this section. | String |
| requestsLeft | How many more requests are available in your current subscription plan | Integer |
{
"url": "http://e2rlc42c2hah6tgj.onion/viewProduct?offer=393694.312665#post-0",
"uuid": "bf416cecda38b308dd02d987a41f6ad7ba11bd70",
"parent_uuid": "6dbcd81bbe1b5afe53ee761e06304700a538ec99",
"title": "Uber.com Logins ✅✴️⚡",
"text": "When you place an order, you will receive the login information which includes username and password. All information is fresh, and are never resold. Only you will have exclusive access to the account. Here is a sample of what you will get: Username: Beevives9 Password: MACritte$3 Last Checked: 02-14-2017 Country: USA / UK / CHINA (Sometimes Provided) These accounts are valid and 100% working...........",
"highlightText": "",
"highlightTitle": "",
"author": [
"Theme_Song"
],
"language": "english",
"referring_url": null,
"referring_file_type": null,
"rating": null,
"published": "2018-07-30T12:03:00.000+03:00",
"site": {
"name": "Dream Market Login - Featured anonymous marketplace",
"is_live": true,
"domain": "e2rlc42c2hah6tgj.onion",
"type": "discussions",
"country": null,
"categories": null
},
"thread": {
"url": "http://e2rlc42c2hah6tgj.onion/viewProduct?offer=393694.312665",
"uuid": "6dbcd81bbe1b5afe53ee761e06304700a538ec99",
"title": "Uber.com Logins ✅✴️⚡",
"full_title": "Uber.com Logins ✅✴️⚡",
"published": "2018-07-30T12:03:00.000+03:00",
"site_section": "http://e2rlc42c2hah6tgj.onion/?ai=1675",
"section_title": "Dream Market",
"replies_count": 5,
"participants_count": 2,
"main_image": ""
},
"ord_in_thread": 0,
"extended": {
"external_links": [],
"external_images": [],
"external_videos": [],
"file_links": [],
"file_type": "html"
"network": "tor"
"required_login": true
},
"enriched": {
"categories": [
"pii",
"financial"
],
"persons": null,
"organizations": {
"value": [
"walmart"
],
"count": 1
},
"locations": {
"value": [
"usa",
"uk"
],
"count": 2
},
"emails": null,
"phones": null,
"credit_cards": null,
"ssns": null,
"wallet_ids": null
},
"crawled": "2018-07-30T04:03:40.018+03:00",
"cache_link": "/dark-cache?token=XXXX-XXXX-XXXX&id=http%3A%2F%2Fe2rlc42c2hah6tgj.onion%2FviewProduct%3Foffer%3D393694.312665"
}],
"totalResults": 2306,
"moreResultsAvailable": 2296,
"next": "/cyberFilter?token=XXXX-XXXX-XXXX&format=json&ts=1532912620018&q=fullz+AND+credit+is_structured%3Atrue+extended.network%3Ator",
"requestsLeft": 8926,
}