Scanned data is grouped into 6 separate repositories, known as a data source.
The datasource field name is used to target different data sources in Web Scanner queries.
Each data source has a set of field names that you can use to search within it.
Click here to see a list of field names available per data source.
Available data sources
| Field name | Contents |
|---|---|
webscan |
Web data on the public IPv4 and IPv6 ranges |
torscan |
Data from .onion sites |
services |
Non-http services, e.g. SSH/DNS, includes TLS/SSL certificate data |
opendirectory |
Data gathered from open directories |
webscanhistory |
Log of successfull scanning attempts |
webscanfailure |
Log of failed scanning attempts |
Web Scanner query examples
When using data sources in Web Scanner command line or constructor queries, the data source is treated as a standard input field.
domain = crypto* AND datasource = torscan
This query searches the torscan data source for any .onion domains that include the string "crypto"
ssl.expire = true AND datasource = services
This query returns all expired SSL certificates scanned on the public IPv4 range
Querying multiple data sources
Some field names are applicable towards more than one data source (e.g. the domain field).
You can search across multiple data sources within the same query by specifying the data sources in square brackets, separated by a comma. This works as a de facto OR separator.
domain = "payments* AND datasource = [webscan, torscan]