Problem: You’ve found a suspicious domain, IP, or pattern, but traditional tools only give you surface-level data. You need to dig deep, quickly, and effectively, uncovering connected infrastructure, historical records, similar phishing sites, or entire clusters of malicious assets.
Silent Push Solution: Create a Query is your primary entry point into Reconnaissance. Whether you need a fast one-off lookup or a sophisticated hunt, this powerful interface lets you search across massive datasets using Simple Search for quick wins or Advanced tools (SPQL + Constructor) for deep investigations.
Access Create a Query
From the dashboard, click Create a Query under the Getting Started With Reconnaissance section.
You’ll land directly in the Web Search interface — the most versatile search tool in Silent Push.
Simple Search – Perfect for Quick Investigations
Ideal when you just need fast answers.
Select one or more Datasources (Web Search is selected by default).
Choose a Field Name (e.g.,
domain,ip,favicon_md5_hash).Select an Operator (
equals,contains, etc.).Enter your Value.
Click Search.
Example: Find domains containing a threat actor’s name
Field: domain Operator: contains Value: threatactor
Advanced Search – For Powerful Investigations
Switch to the Advanced Search tab (or use the Constructor / Command Line) when you need to combine multiple conditions.
Using the Constructor (UI Builder)
Visually build complex queries by adding expressions and linking them with AND/OR.
Command Line (SPQL)
Write queries directly for maximum flexibility.
Example: Find domains starting with “payments” in both web and dark web datadomain = "payments*" AND datasource = [webscan, torscan]
Saving & Managing Your Queries
After running a successful query:
Click Save.
Give it a clear name and choose Private or Shared.
Add tags for easier filtering later.
To run saved queries later:
Go to Web Search → Saved tab.
Use the search box or filters (by tag, type, creation date, etc.).
Click any query to re-run it instantly.
Practical Use Case: Detecting Fake Banking Pages
Goal: Find phishing sites impersonating a real bank (e.g., aib.ie).
Start with the legitimate domain to gather reference data (favicon, certificate, etc.).
Use the Constructor or the Command Line to build the query:
Match the bank’s favicon_md5_hash
Exclude the real certificate provider (
ssl.subject_common_name != "DigiCert")Exclude the real domain (
domain != "aib.ie")
Run the query and review the results.
Enrich promising hits → pivot to their IPs → use Lookup PADNS to uncover entire clusters of phishing infrastructure.
Real customer outcome: One financial institution discovered dozens of fake banking sites hosted in unexpected countries and blocked them before customer credentials were stolen.
Tips
Stack multiple data sources for broader coverage.
Use
now-7dfor recent activity (e.g.,scan_date > now-7d).Save every high-value query — they become powerful reusable tools.
Combine with Live Scan for real-time validation of results.