---
title: "SPQL Data Fields Overview"
slug: "spql-data-fields-overview"
tags: ["SPQL Data Sources"]
updated: 2026-11-06T18:55:53Z
published: 2026-11-06T18:55:53Z
canonical: "help.silentpush.com/spql-data-fields-overview"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.silentpush.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SPQL Data Fields Overview

This overview article introduces the Silent Push Query Language (SPQL) data fields and the major data sources available for querying. It explains how fields are organized, provides practical query examples, and includes key notes on field behavior along with a summary index of common fields. Use this page as the starting point before diving into the detailed field references for specific sources.

For detailed field references, see the following articles:

- [Core Scan Sources](/v1/docs/core-scans) — Web Scan, Torscan, Web Resources, Services, Open Directory, and WHOIS fields
- [Domain Intelligence & Search](/v1/docs/domain-intelligence)— domainsearch, dynamicdns, stalldomain, and subdomain fields
- [BGP & Routing](/v1/docs/bgp-routing) — BGP path, upstream, downstream, peer, ROA, and related models
- [Certificates & Signals](/v1/docs/certificates-signals) — Certificate transparency data, cert relationships, and aggregated signals
- [PADNS Family](/v1/docs/padns-1) — Historical DNS resolution data and specialized PADNS variants
- [Specialized Sources](/v1/docs/specialized-sources) — RDAP, portscan, honeypot, host diversity, feeds, and other models
- [SPQL v3 Preview Fields](/v1/docs/spql-3) — Advanced hash fields currently in preview on webscan and torscan

## Introduction

This article provides a comprehensive reference for field names and data sources used in Silent Push Query Language (SPQL) queries. Field names are searchable data categories in SPQL, enabling precise searches across Silent Push’s data repositories.

Understanding these fields and their associated data sources is essential for constructing effective queries and interpreting scan results. Key data types, represented by these field names, also support advanced analysis for similarity detection, malicious activity identification (e.g., phishing sites, malware), dark web tracking, and URL navigation paths.

For example, hash-based fields like SHA-256 or SSDeep allow matching identical or similar content, while SSL and JARM fields fingerprint certificates and TLS configurations.

## Overview of Data Sources

Silent Push Query Language (SPQL) queries target multiple data repositories. The table below summarizes the major sources. Fields are searchable only within the sources that contain them.

| Source / Model | Description | Primary Use Cases |
| --- | --- | --- |
| `webscan`, `webscan_as` | Public IPv4/IPv6 web scans (HTML, favicons, SSL, headers, body analysis) | Content matching, similarity, phishing, malware |
| `torscan` | Tor / .onion scans | Dark web tracking |
| `webresources`, `webresources_as` | Downloaded web resources (JS, CSS, images, etc.) | Resource fingerprinting and linking |
| `services`, `services_as` | Non-HTTP service banners, TLS certificates, fingerprints | Banner search, service exposure |
| `opendirectory`, `opendirectory_as` | Open directory listings | Exposed files and directories |
| `whois`, `fullwhois` | Domain registration records | Ownership, expiry, contact information |
| `domainsearch`, `domainsearch_api` | Aggregated domain intelligence and infrastructure history | Domain diversity, certificate timelines, first/last seen |
| `dynamicdns` | Dynamic DNS records | DDNS monitoring |
| `bgp*` family | BGP routing and AS relationship data | Routing analysis, AS path, upstream/downstream |
| `signals` | Aggregated signals and indicators | Threat scoring, behavioral flags |
| `certs`, `cert-cookies`, `cert-siblings` | Certificate transparency and related data | Certificate intelligence and relationships |
| `padns*` family | Passive DNS observations | Historical resolution and dangling records |
| `rdap-asn`, `rdap-net` | RDAP data for ASNs and networks | Registration metadata |
| `portscan` | Open port and service observations | Exposure discovery |
| `honeypot` | Honeypot interaction data | Attacker behavior |
| `hostdiversity` | Host and infrastructure diversity metrics | Diversity scoring |
| `feed` | Feed and indicator records | Custom / external feed data |
| `stalldomain`, `subdomain` | Stalled domains and subdomain-specific observations | Domain lifecycle |

## Using Field Names in Queries

Field names are combined with operators and values to form SPQL queries. Use `AND` to combine conditions. Lists in square brackets act as an OR condition for a single field.

**Example 1 — Multi-source search**

```plaintext
domain = payments* AND datasource = [webscan, torscan]
```

Searches for domains starting with “payments” in both webscan and torscan.

**Example 2 — Websites with PayPal favicon but no PayPal SSL cert**

```plaintext
datasource = "webscan" AND favicon_murmur3 = "309020573" AND domain !~= "\s*$" AND ssl.subject.organization != "PayPal, Inc."
```

**Example 3 — JavaScript files on silentpush.com scanned in the last 30 days**

```plaintext
datasource = "webresources" AND resource_hostname = "www.silentpush.com" AND header.content-type = "*javascript*" AND scan_date >= "now-30d"
```

**Example 4 — Dark web sites selling credit cards (September 2025)**

```plaintext
datasource = "torscan" AND htmltitle = "*credit card*" AND scan_date >= "2025-09-01" AND scan_date <= "2025-09-30"
```

**Example 5 — GoDaddy domains expiring soon**

```plaintext
datasource = whois AND registrar = "*GoDaddy*" AND expires >= "now" AND expires <= "now+30d"
```

**Example 6 — Privacy-protected Russian domains**

```plaintext
country = "RU" AND organization ~= "Private" AND datasource = whois
```

## Notes

**Favicon fields**

Favicon fields distinguish between primary favicon resources (typically `.ico`) and secondary/non-.ico formats. Use the appropriate field (`favicon_md5`, `favicon_murmur3`, `favicon_path`, etc.) depending on the resource type you are matching.

**Datestring format**

Date and datetime fields use the format `YYYY-MM-DD` (or full timestamps where supported). Many sources support relative dates such as `now`, `now-30d`, and `now+7d`.

**Array fields**

Fields marked as arrays (e.g., `email`, `nameserver` in WHOIS) match if *any* element in the array satisfies the condition. Wildcards and regex are supported on these fields where indicated.

**Hash fields**

Exact-match hash fields (SHA-256, MD5, Murmur3, HHV, datahash, etc.) do not support wildcards or regular expressions. Use exact values only.

**SPQL v3 Preview fields**

The new hash fields listed in the SPQL v3 Preview article are currently limited to `webscan` and `torscan`. They will become fully searchable with the SPQL v3 release later in 2026.

## Field Name Index (Summary)

This compact alphabetical table consolidates common fields for quick lookup.

| Field | Type | Primary Sources | Description |
| --- | --- | --- | --- |
| adtech.ads_txt | boolean | webscan | Has /ads.txt |
| asn | number | webscan, domainsearch, bgp, padns | Autonomous System Number |
| banner | string | services | Service banner |
| datahash | string | webscan, torscan, webresources, services | Unique scan/resource hash |
| domain | string | Most sources | Domain name |
| favicon_murmur3 | string | webscan, torscan | Murmur3 hash of favicon |
| first_seen | datetime | domainsearch, padns | First observation |
| last_seen | datetime | domainsearch, padns | Most recent observation |
| scan_date | datetime | webscan, torscan, webresources, services | Scan date |
| ssl.expired | boolean | webscan, torscan, services | Certificate expired flag |
| ssl.subject.organization | string | webscan, torscan, services | Certificate subject organization |