Recent Queries
Templates
Recent
Actor De-Anonymization
((author:"actor name" OR author_extended.user_id:user_id OR "actor name") AND (enriched.email.count:>0 OR "contact me at" OR "pm$ me" OR "reach me" OR enriched.phone.count:>0 OR "phone number" OR "my number" OR "my whatsapp" OR "my account" OR "my username" OR @$ OR "my profile" OR "profile link" OR "telegram user" OR "my telegram" OR "telegram account" OR "telegram username" OR "my discord" OR "my facebook" OR "my twitter" OR "for donations" OR "my address" OR extended.external_link:* OR enriched.wallet_id.count:>0 OR "btc address" OR "bitcoin address" OR enriched.ip.count:>0))
Actor Tracking
Monitoring the online presence and activities of an actor
(author:"actor name" OR author_extended.user_id:user_id OR "actor name" OR enriched.email.value:(*actorname*) OR enriched.email.value:(email address) OR enriched.phone.value:(phone number) OR enriched.wallet_id.value:(crypto address) enriched.ip.value:(xxx.xxx.xxx.xxx))
Brand Monitoring
Brand identifiers and IOCs
("company name" OR "company name variation" OR "company subsidiary" OR "company domain" OR "company sub domain" OR enriched.domain.value:("company domain" OR "company sub domain") OR enriched.email.value:(*@company email domain) OR enriched.ip.value:[xxx.xxx.xxx.xxx TO xxx.xxx.xxx.xxx] OR enriched.ip.value:(xxx.xxx.xxx.xxx) OR "company product" OR "company service" OR extended.external_link:*companyname* OR "@account_name_in_social_media" OR "physical address" OR "executive name")
Brand Monitoring on Social Media
("company name" OR "company name variation" OR "company domain" OR "company sub domain" OR enriched.domain.value:("company domain" OR "company sub domain") OR enriched.email.value:(*@company email domain) OR extended.external_link:*companyname* OR "related_hashtags" OR "@account_name_in_social_media" OR "physical address" OR "executive name")
Content From a Specific Discord Group
(extended.network:discord AND title:groupname)
Content From a Specific Telegram Group
thread.url:"https://t.me/groupname"
Credentials For Sale on Dark Web Marketplaces
(enriched.domain.value:("company domain" OR "company subdomain") AND site.type:datastore)
Data Breach Monitoring
Domains from stealer logs
pii.domain_client:company domain
Domain Monitoring
Exact match, list and an and free text
(enriched.domain.value:"company domain" OR enriched.domain.value:("company domain" OR "company sub domain") OR "company domain" OR "company sub domain")
IP Monitoring
Exact match, range and list
(enriched.ip.value:xxx.xxx.xxx.xxx OR enriched.ip.value:[xxx.xxx.xxx.xxx TO xxx.xxx.xxx.xxx] OR enriched.ip.value:(xxx.xxx.xxx.xxx OR xxx.xxx.xxx.xxx))
Leaked Company Emails
pii.domain_employee:company email domain
Monitoring Leaked BIN Numbers
((BIN AND (BIN)) OR enriched.credit_card.value:BIN*)
VIP Executive Protection
("full name" OR "nickname" OR "name variation" OR (("first name" OR "last name" OR "position in the company") AND ("company name" OR "company name variation" OR "company domain" OR "company sub domain" OR "@account_name_in_social_media" OR "physical address" OR "related_hashtags")))