Skip to main content

​
Search individual data sources

A **quick search** fans one term out across every source at once. This does the opposite: you pick **one** data source and search it directly, on that source’s own terms. Reach for it when you already know which source you want to dig into. DarknetSearch indexes 14 data sources you can search one at a time. Each has its own guide — what it searches, how to call it, and what comes back. Pick one from the grid below.

​
How a search runs

A source answers in one of two shapes:
  • Synchronous — one call returns the findings in the response. Telegram, Discord, SSL Transparency Logs, Threat Actor Publications, and the indexed view of Credit Cards work this way.
  • Asynchronous — the heavier sources run a background job. You submit → poll → read:
POST your search term to the source’s create endpoint. It returns a task id. GET the source’s request endpoint by id until its status reports finished. GET the source’s result endpoint to page through the findings. Every source is free of credit cost; each has its own daily rate limit, noted on its page. All calls take a bearer token — see Authentication.

​
The data sources

The dumped content itself, with its file name, source leak, and tags — one row per matching record, nothing deduplicated. Deduplicated account rows — username, password, and server — each risk-scored and flagged by where it’s used. Login, password, and website triples with their source leak — searchable by any field, no deduplication. Matching channel messages — text, channel, timestamp, attachments, and any links inside. Matching server messages — full text with the hit highlighted, plus author, channel, and server. Leaked profile posts — the matched profile text with its source forum, date, and thread metadata. Certificate records for your domain — the host, issuing CA, and validity — to surface certs you never asked for. Each short link resolved to its real destination, with file-extension and shortener facets to filter on. Exposed files with a direct URL and the bucket holding them, faceted by file category. Matching pastes — title, author, and a direct link, from the indexed archive or a live crawl. Matching app listings — the app’s name, which store it’s on, and a direct link to the page. Phishing URLs matching your brand — each with its PhishTank ID and community-verified status. Indexed card records by BIN or last 4, plus deep-web marketplace hits delivered as a downloadable file. Ransomware-victim listings — organizations named on leak sites, matched to your company or domain. **Hacker Forums**, **Tor & I2P**, and **Social Media** are real-time crawls, not indexed lookups — they’re [Live search](/api/guides/live-search) features, not data sources here.