Execute an advanced Web Scanner search

This guide covers how to create and execute queries in Web Scanner using the Advanced Search tab, which relies on SPQL (Search and Query Language) command-line syntax. Advanced searches are suited for technical users comfortable with writing precise queries to target specific data.

Understanding SPQL Syntax

SPQL queries combine Field names, Operators, and Values, often linked with logical separators like AND or OR. For example:

domain = crypto* AND tld = onion

• Field name: domain (the data category, e.g., final domain after redirects).

• Operator: = (equals, or use !=, >, <, etc.).

• Value: crypto* (a wildcard search for domains starting with "crypto").

• Separator: AND (links conditions).

• Second condition: tld = onion (targets .onion domains).

For detailed SPQL syntax, refer to SPQL Documentation.

Create an Advanced Search

1. Navigate to Explore Scan Data > Web Scanner.

2. Select the Advanced Search tab.

3. Click New.

4. Enter a query using SPQL syntax, including spaces between elements (e.g., domain = crypto* AND tld = onion).

5. Optional) Specify a Sort order by selecting a field from the dropdown or typing it (e.g., scan_date).

6. (Optional) Click Reset to clear all parameters.

7. Press Enter or click the blue arrow icon to execute the query.

Example:

• Query: scan_date > now-7d AND tld = jp

• Sort order: scan_date (descending)

• Result: Finds domains with Japan’s top-level domain (.jp) scanned in the last 7 days, sorted by most recent.

Edit a Search

1. After the query runs, parameters collapse, and results appear below.

2. Click the Web Scanner Search Form button to expand the query input.

3. Edit the SPQL query as needed.

4. Press Enter or click the blue arrow icon to re-run the query.

Save a Search

1. Enter valid SPQL parameters in the query box.

2. Click Save in the top right.

3. Enter a Name and (optionally) a Description.

4. Click Save to store the query for future use.