Field names

Updated
  • Updated on Sep 25, 2025
  • Published on Oct 4, 2023
  • 10 minute(s) read
Prev Next

This article provides a comprehensive reference for field names and data sources used in Web Search queries. Field names are searchable data categories in Silent Push Query Language (SPQL), enabling precise searches across Web Search’s data repositories. Understanding these fields and their associated data sources is essential for constructing effective queries and interpreting scan results.

Key data types, represented by these field names, also support advanced analysis for similarity detection, malicious activity identification (e.g., phishing sites, malware), dark web tracking, and URL navigation paths. For example, hash-based fields like SHA-256 or SSDeep allow matching identical or similar content, while SSL and JARM fields fingerprint certificates and TLS configurations.

Overview of data sources

Web Search organizes scanned data into six data sources, each representing a specific type of web data. The table below summarizes each data source and its primary use case:

Data source

Description

webscan

Web data from public IPv4 and IPv6 ranges, including HTML, favicons, and SSL data.

torscan

Data from .onion sites on the Tor network, similar to webscan but Tor-specific.

services

Non-HTTP services (e.g., SSH, DNS), including TLS/SSL certificate data.

opendirectory

Data from open directories, including file and directory metadata.

webscanhistory

Log of successful scanning attempts, tracking domains and IPs scanned.

webscanfailure

Log of failed scanning attempts, including reasons for failure.

Important: The Datestring data type is formatted as YYYY-MM-DD.

Use Field names in queries

Field names are used in SPQL queries to target specific data within a data source. For example:

  • Query: domain = crypto* AND datasource = torscan

    • Searches the torscan data source for .onion domains starting with “crypto”.

  • Query: ssl.expired = true AND datasource = services

    • Returns all expired SSL certificates in the services data source.

To search across multiple data sources, use square brackets with a comma-separated list:

  • Query: domain = payments* AND datasource = [webscan, torscan]

    • Searches for domains starting with “payments” in both webscan and torscan.

Field Groups

To support targeted analysis (e.g., similarity detection, phishing identification, or dark web tracking), fields are grouped thematically below. Each group includes relevant fields from multiple data sources, along with descriptions, types, notes, and example queries.

For guidance on constructing queries, see Manage and run queries in Web Search.

Body data

Body data fields enable the analysis of a webpage’s HTML content, JavaScript, language, and dark web references, facilitating the identification of identical or similar websites.

Field Name

Description

Type

body_analysis.body_sha256

SHA-256 hash of the <body> content. Matches indicate identical content (rare, e.g., error pages).

String

webscan, torscan

body_analysis.header_sha256

SHA-256 hash of the <header> content

String

webscan, torscan

body_analysis.footer_sha256

SHA-256 hash of the <footer> content

String

webscan, torscan

body_analysis.js_sha256

List of referenced JavaScript files with SHA-256 hashes (includes URLs and query parameters, e.g., ?v=1.2

String

webscan, torscan

body_analysis.js_ssdeep

List of JavaScript files with SSDeep fuzzy hashes for similarity detection

String

webscan, torscan

body_analysis.language

Comma-separated list of HTML languages (most to least used). Mismatches with tld may indicate targeting issues.

String

webscan, torscan

body_analysis.onion

List of Tor .onion addresses in the HTML body, useful for dark web investigations

String

webscan, torscan

body_analysis.SHV

Script Hash Value (SHV), a fingerprint of script names (excluding parameters, e.g., jQuery-2.1.4.min.js). Identifies similar script groups

String

webscan, torscan

body_analysis.adsense

Adsense-related tags in body

String

webscan, torscan

body_analysis.adserver

Ad server references

String

webscan, torscan

body_analysis.analytics

Analytics tool tags

String

webscan, torscan

body_analysis.google-adstag

Google Ads tag

String

webscan, torscan

body_analysis.google-GA4

GA4 tag

String

webscan, torscan

body_analysis.google-UA

UA tag

String

webscan, torscan

body_analysis.ICP_license

Chinese ICP License (for compliance checks)

String

webscan

Example

  • Query: body_analysis.onion = *market* AND datasource = torscan

    • Finds .onion sites referencing “market” in their HTML body.

  • Query: body_analysis.SHV = jquery* AND htmltitle = *login*

    • Identifies potential phishing sites using specific JavaScript files and login-related titles.

  • Query: body_analysis.ICP_license = * AND geoip.country_code2 = CN (see GeoIP below)

    • Flags Chinese-hosted sites with ICP licenses for regulatory analysis.

Favicon data

Favicon fields target website icons for visual similarity detection via hashes or paths. Supports phishing hunts by matching cloned logos.

Field Name

Description

Type

Primary Sources

favicon_md5

MD5 hash of .ico favicon (typically at /favicon.ico)

String

webscan, torscan

favicon_murmur3

Murmur3 hash of .ico favicon

String

webscan, torscan

favicon_path

Path to .ico favicon

String

webscan, torscan

favicon2_md5

MD5 hash of non-.ico favicon

String

webscan, torscan

favicon2_murmur3

Murmur3 hash of non-.ico favicon

String

webscan, torscan

favicon2_path

Path to non-.ico favicon

String

webscan, torscan

favicon_urls

List of favicon URLs, including unreferenced root-favicon /favicon.ico

String

webscan, torscan

favicon_avg

Visual similarity image hash of the website's favicon file

String

webscan, torscan

favicon2_avg

Visual similarity image hash of the website's favicon2 file

String

webscan, torscan

Notes:

  • favicon fields refer to .ico files; favicon2 fields cover non-.ico formats (e.g., PNG). Websites may have both.

  • Browsers and Web Scanner automatically check for /favicon.ico, even if it is not referenced in the code.  

Example

  • Query: favicon_murmur3 = 1234567890 AND datasource = webscan

    • Finds websites with a specific .ico favicon hash, indicating visual similarity.

HTML data

HTML data fields analyze webpage titles, similarity scores, and response headers for correlation and filtering.

Field Name

Description

Type

Primary Source

html_body_similarity

Numerical value (0–100) showing similarity to the previous scan, based on html_body_ssdeep. A value of 91 indicates a 9% difference. May not reflect visual similarity.

Number

webscan

htmltitle

HTML title, useful for initial investigations (e.g., detecting phishing or C2 frameworks).

String

webscan, torscan

hhv

Header Hash Value, a fingerprint of response header keys (not values, e.g., Content-Type, Server). Used as a prefilter for URL scans.

String

webscan, torscan

html_body_murmur3

A Murmur3 hash of the HTML body

Number

webscan, torscan

html_body_length

Number of bytes in the HTML body

Integer

webscan

html_body_sha256

A SHA256 hash of the HTML body

String

webscan, torscan

html_body_ssdeep

SSDeep hash of the HTML body

String

webscan, torscan

header.cache-control

Instructions that control caching in browsers and shared caches (e.g., Proxies, CDNs)

String

webscan, torscan

header.connection

Whether the network connection stays open after the current transaction finishes

String

webscan, torscan

header.content-length

Size of the message body, in bytes, sent to the recipient.

Number

webscan, torscan

header.content-type

Original media type of the resource (prior to any content encoding applied for sending).

String

webscan, torscan

header.etag

The ETag (or entity tag) HTTP response header

String

webscan, torscan

header.refresh

Refresh directive

String

webscan, torscan

header.server

Software used to serve the HTTP response. If a redirect is present, this field shows data from the server that performed the last redirect

String

webscan, torscan

header.x-powered-by

Value returned from server stating what it's powered by

String

webscan, torscan

file

Does URL scanned point to a file (non-HTML check)

Boolean

webscan, torscan

file_sha256

Hash of file pointed to (for malware/file analysis)

String

webscan, torscan

opendirectory

Is this an open directory

Boolean

webscan, torscan

Example

  • Query: htmltitle = "Mythic" AND body_analysis.js_sha256 = *mythic*

    • Correlates websites using the Mythic C2 Framework via title and JavaScript hashes.

  • Query: hhv = *proxygen* AND datasource = webscan

    • Prefilters scan websites for specific server software (e.g., proxy gen-bolt).

  • Query: file = true AND file_sha256 = *malware*

    • Detects scanned files with suspicious hashes.

SSL data

SSL data fields target certificate characteristics to identify unique or malicious servers. Covers authority keys and serials for chain-of-trust analysis.

Field Name

Description

Type

Primary Source

ssl.chv

Certificate Hash Value, fingerprint of issuer, subject, and extension keys, formatted as <hash>:w

X:<SANs_count>(e.g.,487049c6c39ee487049c6c39ee7646766df07c6:w:0005`). Identifies unique certificates, especially self-signed ones.

Includes: First part (hashes of issuer/subject/extension keys); second part (w for wildcard, x for non-wildcard); third part (SAN count).

String

ssl.sans

List of domains in the Subject Alternative Names (SANs) field

List of domains.

webscan, torscan, services

ssl.authority_key_id

The authority key identifier (AKI) is an X.509 v3 certificate extension. It contains a key identifier which is derived from the public key in the issuer certificate.

String

webscan, torscan, services

ssl.expired

Has SSL certificate expired

Boolean

webscan, torscan, services

ssl.issuer.common_name

SSL Certificate Issuer Common Name

String

webscan, torscan, services

ssl.issuer.country

SSL Certificate Issuer Country

String

webscan, torscan, services

ssl.issuer.organization

SSL Certificate Issuer Organization

List of strings

webscan, torscan, services

ssl.not_after SSL

Certificate Validity End Date

Datetime

webscan, torscan, services

ssl.not_before SSL

Certificate Validity Start Date

Datetime

webscan, torscan, services

ssl.sans_count SSL

Certificate Sans List Count

Number

webscan, torscan, services

ssl.serial_number SSL

Certificate Serial Number

String

webscan, torscan, services

ssl.SHA1 SSL

Certificate SHA1 Hash

String

webscan, torscan, services

ssl.SHA256 SSL

Certificate SHA256 Hash

String

webscan, torscan, services

ssl.sigalg SSL

Certificate Signature Algorithm

String

webscan, torscan, services

ssl.subject.common_name SSL

Certificate Subject Common Name

String

webscan, torscan, services

ssl.subject.country SSL

Certificate Subject Country

String

webscan, torscan, services

ssl.subject.names SSL

Certificate Subject Names

List of domains

webscan, torscan, services

ssl.subject.organization SSL

Certificate Subject Organization

String

webscan, torscan, services

ssl.wildcard

Is this a wildcard SAN certificate, I.e., Sans List references wildcards

Boolean

webscan, torscan, services

Notes:

  • ssl.chv includes:

    • First part: Hashes of issuer, subject, and extension keys (often identical for issuer and subject).

    • Second part: w (wildcard certificate) or x (non-wildcard).

    • Third part: Number of SANs (e.g., 0005 for five domains).

Example:

  • Query: ssl.chv = *w:0001 AND datasource = services

    • Finds wildcard SSL certificates with a single SAN in non-HTTP services.

JARM data

JARM fields use TLS handshakes to identify servers or malware.

Field Name

Description

Type

Primary Source

jarm

JARM fingerprint, a hash of TLS handshake characteristics (ciphersuites, extensions). Value-based, useful as a prefilter or for identifying unique TLS responses (e.g., malware).

String

webscan

  • Query: jarm = *abc123* AND datasource = webscan

    • Targets websites with a specific TLS fingerprint, potentially linked to malware.

Origin and redirect data

These fields track initial scanned URLs and redirect chains for navigation analysis. Includes core identifiers like domain and IP for broad targeting.

Field Type

Description

Type

Primary Source

origin_domain

Domain originally scanned

String

webscan

origin_hostname

Hostname of the originally scanned domain

String

webscan, torscan

origin_ip

IP of the originally scanned URL

String

webscan, torscan

origin_path

Path of the originally scanned URL

String

webscan, torscan

origin_port

Port of the originally scanned URL

String

webscan, torscan

origin_scheme

Scheme of the originally scanned URL (e.g., http)

String

webscan, torscan

origin_url

URL originally scanned (e.g., http://3.1.104.127)

URL

webscan, torscan

redirect

Boolean indicating if a redirect occurred

Boolean

webscan, torscan

redirect_to_https

Boolean indicating if a redirect led to HTTPS

Boolean

webscan, torscan

redirect_list

List of URLs in the redirect chain (e.g., https://20.160.240.124/sslvpn/Login/login

String

webscan, torscan

redirect_count

Number of URLs involved in a redirect

Integer

webscan, torscan

path

Path of URL that originally scanned URL redirects to

String

webscan, torscan

url

The final URL that the origin URL that was scanned redirects to

String

webscan, torscan, webscanfailure

domain

The final domain that the origin domain that was scanned redirects to

String

webscan, torscan, webscanhistory, webscanfailure

hostname

Hostname of domain that original domain that was scanned redirects to

String

webscan, torscan, webscanhistory

port

Port of URL that originally scanned URL redirects to

Number

webscan, torscan, services, opendirectory, webscanfailure

scheme

Scheme of URL that originally scanned URL redirects to

String

webscan, torscan, opendirectory, webscanhistory, webscanfailure

subdomain

The subdomain value, if it exists, of the final domain that scanned original domain redirects to

String

webscan, torscan

tld

The top level domain of the final domain that scanned original domain redirects to

String

webscan, torscan

ip

IP hosting URL that origin URL that was scanned redirects to

String

webscan, services, opendirectory, webscanhistory, webscanfailure

Notes:

  • Queries for domain, hostname, path, or url automatically search corresponding origin_xxx fields for exact, wildcard, or regex matches (e.g., domain = silentpush.com searches domain and origin_domain).

  • Negative matches (e.g., domain != silentpush.com) only search the specified field.

Example:

  • Query: origin_url = http://20.160.240.124 AND redirect_to_https = true

    • Finds scans starting at a specific URL that redirects to HTTPS.

GeoIP Data

GeoIP fields provide location context for risk scoring (e.g., high-risk regions). Integrated here for correlation with other analyses; full suite available in index.

Field Name

Description

Type

Primary Source

geoip.asn

Autonomous System Name (ASN)

Integer

webscan, services, opendirectory

geoip.as_org

AS Organization

String

webscan, services, opendirectory

geoip.city_name

City of IP geolocation

String

webscan

geoip.continent_code

Continent of IP geolocation

String

webscan

geoip.country_code2

Country code of IP geolocation (2-letter)

String

webscan

geoip.country_code3

Country code of IP geolocation (3-letter)

String

webscan

geoip.country_name

Country name of IP geolocation

String

webscan

geoip.dma_code

Designated marketing area

String

webscan

geoip.latitude

Latitude value of IP geolocation

Float

webscan

geoip.location.lat

Latitude value of IP geolocation

Float

webscan

geoip.location.lon

Longitude value of IP geolocation

Float

webscan

geoip.longitude

Longitude value of IP geolocation

Float

webscan

geoip.postal_code

Postal code of IP geolocation

String

webscan

geoip.region_code

Region code of IP geolocation

String

webscan

geoip.region_name

Region name of IP geolocation

String

webscan

geoip.timezone

Timezone of IP geolocation

String

webscan

Example:

  • Query: ssl.expired = true AND geoip.country_name = "Russia"

    • Identifies expired certs from high-risk geos.

AdTech Data

AdTech fields detect ad transparency files for compliance or evasion checks (webscan only).

Field Name

Description

Type

adtech.ads_txt

Has /ads.txt

Boolean

adtech.ads_txt_sha256

sha256 of /ads.txt

String

adtech.app_ads_txt

Has /app-ads.txt

Boolean

adtech.app-ads_txt_sha256

sha256 of /app-ads.txt

String

adtech.sellers_json

Has /sellers.json

Boolean

adtech.sellers_json_sha256

sha256 of /sellers.json

String

Example:

  • Query: adtech.ads_txt = false AND domain = *ads*

    • Flags ad domains lacking transparency files.

Services and Open Directory Data

For non-HTTP services and directories: Focus on banners, fingerprints, and metadata for port scanning or file exposure analysis.

Services Fields: banner (service banner, String, services); fingerprints.ECDSA/ED25519/RSA (public key fingerprints, String, services).

  • Example: fingerprints.RSA = *selfsigned* AND port = 443 – Detects self-signed keys on common ports.

Open Directory Fields: dir (is directory, Boolean, opendirectory); last_modified (file mod date, Datestring, opendirectory); name (file/dir name, String, opendirectory); size (filesize in bytes, Integer, opendirectory).

  • Example: dir = true AND size > 1000000 – Finds large exposed directories.

Scan History and Failure Data

For troubleshooting scans: Logs success/failure with reasons.

History Fields: datahash (scan hash, String, webscanhistory); full overlap with origin/redirect for tracked scans.

  • Example: scan_date > 2025-01-01 AND datasource = webscanhistory – Reviews recent successful scans.

Failure Fields: reason (failure reason, String, webscanfailure).

  • Example: reason = "timeout" AND ip = * – Analyzes timeout-prone IPs.

Field Name Index

This compact alphabetical table consolidates all fields for quick lookup, showing descriptions, types, and sources.

Field Name

Description

Type

Data Source

adtech.ads_txt

Has /ads.txt

Boolean

webscan

adtech.ads_txt_sha256

sha256 of /ads.txt

String

webscan

adtech.app_ads_txt

Has /app-ads.txt

Boolean

webscan

adtech.app-ads_txt_sha256

sha256 of /app-ads.txt

String

webscan

adtech.sellers_json

Has /sellers.json

Boolean

webscan

adtech.sellers_json_sha256

sha256 of /sellers.json

String

webscan

banner

Service banner on a specific port

String

services

body_analysis.* (all subfields)

See Body Data

Various

webscan, torscan

datahash

A unique hash of the overall scan result      

String  

webscan, torscan, services, webscanhistory

dir

Is a directory

Boolean

opendirectory

domain

The final domain...

String

webscan, torscan, webscanhistory, webscanfailure

favicon_*(all)

See Favicon Data

Various

webscan, torscan

file

Does URL scanned point to a file

Boolean

webscan, torscan

file_sha256

Hash of file pointed to

String

webscan, torscan

fingerprints.*

Public key fingerprints

String

services

geoip.*(all)

See GeoIP Data

Various

webscan, services, opendirectory

header.* (all)

See HTML Data

Various

webscan, torscan

hhv

A hash value based on the header keys

String

webscan, torscan

hostname

Hostname...

String

webscan, torscan, webscanhistory

html_* (all)

See HTML Data

Various

webscan, torscan

ip

IP hosting...

String

webscan, services, opendirectory, webscanhistory, webscanfailure

jarm

JARM Hash...

String

webscan

last_modified

Last modified date...

Datestring

opendirectory

name

Filename...

String

opendirectory

opendirectory

Is this an open directory

Boolean

webscan, torscan

origin_*(all)

See Origin and Redirect Data

Various

webscan, torscan, webscanhistory

path

Path...

String

webscan, torscan

port

Port...

Number

webscan, torscan, services, opendirectory, webscanfailure

reason

The reason a scanning failure occurred

String

webscanfailure

redirect_* (all)

See Origin and Redirect Data

Various

webscan, torscan

response

Scan Request Response Code

Number

webscan, torscan

scan_date

The date that data was scanned  

Datestring

All sources

scheme

Scheme...

String

webscan, torscan, opendirectory, webscanhistory, webscanfailure

size

The filesize in bytes

Integer

opendirectory

ssl.* (all)

See SSL Data

Various

webscan, torscan, services

subdomain

The subdomain value...

String

webscan, torscan

tld

The top level domain...

String

webscan, torscan

url

The final URL...

String

webscan, torscan, webscanfailure