--- title: "Context Graph Search Datasources" slug: "context-graph-search-datasources" updated: 2026-06-09T03:01:31Z published: 2026-06-09T03:01:31Z canonical: "help.silentpush.com/context-graph-search-datasources" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.silentpush.com/llms.txt > Use this file to discover all available pages before exploring further. # Context Graph Search Datasources [Web Search](/v1/docs/web-search) searches online data to help you find suspicious websites, hidden files, or Domain details. It allows you to search websites, Dark Web pages, and more to uncover risks such as fake sites or exposed files. Our Web Search feature searches the following data sources: | Datasources | Description | | --- | --- | | **Web Search** | Searches website content and SSL certificates to identify fraudulent sites | | **Dark Web Search** | Queries Tor network sites to uncover hidden content, such as scam pages | | **Open Directory Search** | Finds publicly accessible folders that host files, such as executables | | **Banner Search** | Examines non-web services (e.g., SSH or DNS) for configuration details such as open ports and banners | | **Whois Search** | Reveals who owns a domain and when it was registered | ## Web Search The Web Search datasource retrieves data from website content and SSL certificates, making it useful for detecting phishing or misconfigured sites. Community users can use it to monitor fraudulent websites that mimic trusted brands. #### Example: Detect PayPal Imposters This query identified websites that use PayPal’s favicon (logo) but are hosted on domains other than paypal.com, potentially indicating phishing attempts. ```plaintext favicon_murmur3 = 309020573 AND domain != "http://paypal.com" ``` #### Example: Monitor Certificate Expiration The query identifies websites with SSL certificates expiring within the next 24 hours, potentially indicating neglected or risky sites. ```plaintext ssl.not_after > "now" AND ssl.not_after < "now+1d" ``` ## Dark Web Scan The Dark Web Scan Data source searches the Tor network for content, helping users identify hidden sites that may host fraudulent or malicious content. #### Example: Find PayPal-related Scams This query locates dark web sites with “PayPal” in their titles, which could indicate scam or phishing pages. ```plaintext datasource = ["torscan"] AND htmltitle = "*paypal*" ``` #### Example: Identify Ransomware Sites This query searches for dark websites with “ransomware” in their titles, such as leak sites. ```plaintext datasource = ["torscan"] AND htmltitle = "*ransomware*" ``` #### Example: Western Union If you stack Web Scan, Browser Scan, and Dark Web Search data sources together, you can return information about IPs with page titles that contain “Western Union” across both the surface web and the dark web. ```plaintext datasource = ["browser-scan", "webscan", "darkweb-search"] AND htmltitle = "*Western Union*" ``` ## Open Directory Scan The Open Directory Scan data source identifies public folders hosting files, which can reveal unintended exposures, such as executable files. #### Example: Find Cloudflare-hosted Executables This query loads .exe files in open directories hosted on Cloudflare’s network (ASN 13335) ```plaintext datasource = ["opendirectory"] AND name = "*exe" AND geoip.asn = 13335 ``` #### Example: Detect recent Mimikatz Files This query finds instances of the Mimikatz credential-dumping tool uploaded in the last 30 days. ```plaintext datasource = ["opendirectory"] AND name = "mimikatz.exe" AND scan_date >= "now-30d" ``` Use this to monitor for tools commonly used by attackers. ## Banner Scan The Banner Scan data source examines non-HTTP services, such as SSH or DNS, to reveal their configurations and versions. #### Example: Identify OpenSSH Servers This query finds IPs running OpenSSH 9.8 on the default SSH port (22) ```plaintext datasource = ["services"] AND port = 22 AND banner = "SSH-2.0-OpenSSH_9.8" ``` #### Example: Locate PowerDNS Servers This query identifies DNS servers running PowerDNS on port 53. ```plaintext datasource = ["services"] AND port = 53 AND banner = "*PowerDNS*" ``` ## WHOIS Scan The WHOIS Scan data source retrieves domain registration details, enabling users to confirm who owns a domain and when it was registered. #### Example: Find Squarespace Domains This query identifies domains registered through Squarespace with unredacted owner names. ```plaintext datasource = ["whois"] AND registrar = "Squarespace Domains LLC" AND name != "REDACTED FOR PRIVACY" ``` #### Example: Identify CrowdStrike Domains This query finds domains containing “CrowdStrike” registered by CrowdStrike, Inc. ```plaintext datasource = ["whois"] AND domain = "*crowdstrike*" AND organization = "CrowdStrike, Inc." ``` > When you run a query in Web Scanner, you can stack Web Scan, Browser Scan, and Dark Web Scan data sources together in pairs or all together. You cannot stack or combine Open Directory Scan, Banner Scan, or WHOIS Scan data sources together. ## Combine Data Sources for Broader Searches By combining Web Search, Browser Scan, and Dark Web Search data sources, you can retrieve information about IPs with server titles including 'Western Union' from both the surface web and the dark web. ```plaintext datasource = ["browser-scan", "webscan", "darkweb-search"] AND htmltitle = "*Western Union*" ``` The human-readable name (e.g., example.com) associated with an indicator of compromise (IoC) or network resource, used to identify and access websites or services in threat intelligence analysis. A hidden part of the internet, accessible only through special software, where illicit activities, such as the sale of stolen data or malware, often occur, monitored by threat intelligence teams. Publicly available data collected during domain registration or DNS updates, used to analyze domain ownership and history. Host scanning data retrieved through enrichment queries, including details like certificates, open directories, or favicons, used to validate and analyze potential threats.