SPQL Data Fields Overview

This overview article introduces the Silent Push Query Language (SPQL) data fields and the major data sources available for querying. It explains how fields are organized, provides practical query examples, and includes key notes on field behavior along with a summary index of common fields. Use this page as the starting point before diving into the detailed field references for specific sources.

For detailed field references, see the following articles:

• Core Scan Sources — Web Scan, Torscan, Web Resources, Services, Open Directory, and WHOIS fields

• Domain Intelligence & Search— domainsearch, dynamicdns, stalldomain, and subdomain fields

• BGP & Routing — BGP path, upstream, downstream, peer, ROA, and related models

• Certificates & Signals — Certificate transparency data, cert relationships, and aggregated signals

• PADNS Family — Historical DNS resolution data and specialized PADNS variants

• Specialized Sources — RDAP, portscan, honeypot, host diversity, feeds, and other models

• SPQL v3 Preview Fields — Advanced hash fields currently in preview on webscan and torscan

Introduction

This article provides a comprehensive reference for field names and data sources used in Silent Push Query Language (SPQL) queries. Field names are searchable data categories in SPQL, enabling precise searches across Silent Push’s data repositories.

Understanding these fields and their associated data sources is essential for constructing effective queries and interpreting scan results. Key data types, represented by these field names, also support advanced analysis for similarity detection, malicious activity identification (e.g., phishing sites, malware), dark web tracking, and URL navigation paths.

For example, hash-based fields like SHA-256 or SSDeep allow matching identical or similar content, while SSL and JARM fields fingerprint certificates and TLS configurations.

Overview of Data Sources

Silent Push Query Language (SPQL) queries target multiple data repositories. The table below summarizes the major sources. Fields are searchable only within the sources that contain them.

Using Field Names in Queries

Field names are combined with operators and values to form SPQL queries. Use AND to combine conditions. Lists in square brackets act as an OR condition for a single field.

Example 1 — Multi-source search

domain = payments* AND datasource = [webscan, torscan]

Searches for domains starting with “payments” in both webscan and torscan.

Example 2 — Websites with PayPal favicon but no PayPal SSL cert

datasource = "webscan" AND favicon_murmur3 = "309020573" AND domain !~= "\s*$" AND ssl.subject.organization != "PayPal, Inc."

Example 3 — JavaScript files on silentpush.com scanned in the last 30 days

datasource = "webresources" AND resource_hostname = "www.silentpush.com" AND header.content-type = "*javascript*" AND scan_date >= "now-30d"

Example 4 — Dark web sites selling credit cards (September 2025)

datasource = "torscan" AND htmltitle = "*credit card*" AND scan_date >= "2025-09-01" AND scan_date <= "2025-09-30"

Example 5 — GoDaddy domains expiring soon

datasource = whois AND registrar = "*GoDaddy*" AND expires >= "now" AND expires <= "now+30d"

Example 6 — Privacy-protected Russian domains

country = "RU" AND organization ~= "Private" AND datasource = whois

Notes

Field Name Index (Summary)

This compact alphabetical table consolidates common fields for quick lookup.