Work with Web Search results

Updated
  • Updated on Sep 15, 2025
  • Published on Feb 8, 2024
  • 2 minute(s) read
Prev Next

This guide covers how to view, customize, expand, export, and analyze results from Web Search queries, including pivoting on domains/IPs and adding results to feeds.

Scan results

When you execute a query in Web Search (via Command Line or Constructor), results are displayed in a collapsible Results table. The default columns include:

Column

Description

Domain

The final domain that a scanned URL resolved to

IP

The Final IP that a scanned URL resolved to

Favicon Murmer 3

Favicon Murmur 3 hash of the final domain

HTML Body SSDeep

HTML Body SSDeep of the final domain

HTML Title

HTML Title SSDeep of the final domain

Response

The HTML response code received from the web server

Scan Date

Timestamp of when a scan was performed

SSL SHA1

SHA1 fingerprint of the domain's SSL certificate

SSL Subject Common Name

Common name of the domain’s SSL subject (e.g., DigiCert)

URL

The final URL that was scanned

Origin URL

The first URL that was scanned

Expand and refine queries

You can expand individual results to view additional field names and incorporate them into your query:

  1. In the Results table, click Expand on the far right of a result row.

  2. A list of field names for that result will appear (e.g., ssl.expired, geoip.country_name).

  3. Left-click any blue-colored field name text and select an operator (e.g., = or !=) to add it to your query.

  4. The field name is appended to your current query, which can be re-run with the new parameters.

Customize result displays

To modify which data types are displayed in the Results table:

  1. Click the vertical line icon next to Basic Raw Data in the table header.

    Use checkboxes to include or exclude specific field names (e.g., show only Domain and IP).

  2. The table updates to reflect your selections.

Copy, export, and view raw data

Web Search provides options to utilize the result data:

Copy to clipboard

  • Click Copy in the top left of the Results table to copy all visible results.

  • Alternatively, use checkboxes to select specific rows and copy only the selected ones.

Export data

  • Click the Download icon to export the results as a CSV or JSON file.

  • Choose to export all visible results or only selected rows.

View raw data

  • Click Basic Raw Data to view the raw data behind all results.

  • Copy the raw data to the clipboard for further analysis.

Pivot and enrich data

You can perform advanced analysis on domains and IPs directly from the Results table:

Pivot on Domains/IPs

  1. Left-click a blue-colored domain or IP in the table to open a contextual menu.

  2. Select a Lookup type:

    1. Query (forward): Perform a forward lookup.

    2. Answer (reverse): Perform a reverse lookup.

  3. Click Lookup PADNS to open the pivot results in a new tab.

Enrich data

In the contextual menu, click Enrich to open an enrichment page for the selected domain or IP in a new tab.

Add results to Feeds

To save results for further analysis or sharing:

  1. Left-click a domain or IP in the Results table.

  2. Select Add to Feed/Collection.

  3. Choose:

    1. Existing: Add to an existing feed or collection.

    2. New: Create a new feed or collection.

  4. Confirm to save the selected data.