Work with Web Scanner results

Updated
  • Updated on Aug 20, 2025
  • Published on Feb 8, 2024
  • 2 minute(s) read
Prev Next

This guide covers how to view, customize, expand, export, and analyze results from Web Scanner queries, including pivoting on domains/IPs and adding results to feeds.

Understand Scan Results

When you execute a query in Web Scanner (via Command Line or Constructor), results are displayed in a collapsible Results table. The default columns include:

Column

Description

Domain

The final domain that a scanned URL resolved to

IP

The Final IP that a scanned URL resolved to

Favicon Murmer 3

Favicon Murmur 3 hash of the final domain

HTML Body SSDeep

HTML Body SSDeep of the final domain

HTML Title

HTML Title SSDeep of the final domain

Response

The HTML response code received from the web server

Scan Date

Timestamp of when a scan was performed

SSL SHA1

SHA1 fingerprint of the domain's SSL certificate

SSL Subject Common Name

Common name of the domain’s SSL subject (e.g., DigiCert)

URL

The final URL that was scanned

Origin URL

The first URL that was scanned

Expand and Refine Queries

You can expand individual results to view additional field names and incorporate them into your query:

  1. In the Results table, click Expand on the far right of a result row.

  2. A list of field names for that result will appear (e.g., ssl.expired, geoip.country_name).

  3. Left-click any blue-colored field name text and select an operator (e.g., = or !=) to add it to your query.

  4. The field name is appended to your current query, which can be re-run with the new parameters.

Customize Result Displays

To modify which data types are displayed in the Results table:

  1. Click the vertical line icon next to Basic Raw Data in the table header.

    Use checkboxes to include or exclude specific field names (e.g., show only Domain and IP).

  2. The table updates to reflect your selections.

Copy, Export, and View Raw Data

Web Scanner provides options to utilize the result data:

Copy to Clipboard

  • Click Copy in the top left of the Results table to copy all visible results.

  • Alternatively, use checkboxes to select specific rows and copy only those.

Export Data

  • Click the Download icon to export results as CSV or JSON.

  • Choose to export all visible results or only selected rows.

View Raw Data

  • Click Basic Raw Data to view the raw data behind all results.

  • Copy the raw data to the clipboard for further analysis.

Pivot and Enrich Data

You can perform advanced analysis on domains and IPs directly from the Results table:

Pivot on Domains/IPs

  1. Left-click a blue-colored domain or IP in the table to open a contextual menu.

  2. Select a lookup type:

    1. Query (forward): Perform a forward lookup.

    2. Answer (reverse): Perform a reverse lookup.

  3. Click Lookup PADNS to open the pivot results in a new tab.

Enrich Data

  • In the contextual menu, click Enrich to open an enrichment page for the selected domain or IP in a new tab.

Add Results to Feeds

To save results for further analysis or sharing:

  1. Left-click a domain or IP in the Results table.

  2. Select Add to Feed/Collection.

  3. Choose:

    1. Existing: Add to an existing feed or collection.

    2. New: Create a new feed or collection.

  4. Confirm to save the selected data.