Skip to main content
A quick search sends one term to every source at once. An expert search does the opposite: you pick one indexed data source and search it directly, with that source’s own query syntax and filters. Reach for it when you know which source matters, or to read more from a source a quick search flagged. In the dashboard, the same searches are Search → Search by Source. DarknetSearch indexes 15 data sources you can search one at a time. Each has its own guide: what it searches, how to call it and what comes back. Availability: depends on the source. Seven sources are included in every plan. The other eight each need a plan feature. See Plan features and refusals. Cost: no metered allowance on any source, and no per-source daily limit. Every call counts toward your per-second rate limit. With an API key, a call that returns 2xx counts toward your monthly API Calls allowance, and any other status is refunded. On a background source, each poll is one more call. Rate limits explains both limits.

​
The data sources

Raw Leaks

The dumped content itself, with its file name, source leak and tags. One row per matching record, nothing deduplicated. Guide title: Raw Data.

Filtered Credentials

Deduplicated accounts for one domain: username, password and server, each risk-scored and flagged by where it is used.

Raw Credentials

Login, password and website triples with their source leak. Search by any field, no deduplication. Guide title: The ULP feed.

Telegram

Matching channel messages: text, channel, timestamp, attachments and any links inside.

Discord

Matching server messages: full text with the hit highlighted, plus author, channel and server.

New Domain Registrations

Domains registered in recent days across 12 feeds, to catch a look-alike before its campaign goes live.

Data Brokers

Listings advertised on data-broker marketplaces: site, data type, location, seller, price and listing date, with cursor paging.

SSL Transparency Logs

Certificate records for your domain: the host, issuing CA and validity, to surface certificates you never asked for.

URL Shorteners

Each short link resolved to its real destination, with file-extension and shortener facets to filter on.

Open Cloud Storage

Exposed files with a direct URL and the bucket holding them, faceted by file category.

Data Pastes

Matching pastes: title, author and a direct link, from the indexed archive or a live crawl.

App Store Monitoring

Matching app listings: the app’s name, which store it is on and a direct link to the page.

Phishing References

Phishing URLs that match your brand or domain, from public phishing feeds.

Credit Cards

Leaked cards and cards offered for sale, in one search. Filter by BIN, last digits, owner, bank, country and more.

Threat Actor Publications

Ransomware-victim listings: organizations named on leak sites, matched to your company or domain.
Two dashboard names differ from their guide titles. Raw Leaks is covered by the Raw Data guide, and Raw Credentials by The ULP feed. To check one password or email address at sign-up or login, use Credential check.

​
How a search runs

A source answers in one of two ways. In one call (9 sources). One request returns the findings: Raw Leaks, Raw Credentials, Telegram, Discord, New Domain Registrations, Data Brokers, SSL Transparency Logs, Credit Cards and Threat Actor Publications. Each source guide covers its paging.
As a background job (6 sources). The heavier sources submit a job. You submit, poll until the job reaches its final status, then read the findings. Three patterns cover the six sources: In these paths <source> is shortener, bucket, store or phishing. The Endpoints table links each call. For example, an Open Cloud Storage search:
Two sources have a second way in. Phishing References also answers a domain in one call from phishing_search. Credit Cards returns leaked cards by default; set saleCategory to on_sale for cards offered for sale, or all for both. Each source guide covers the details.

​
Plan features and refusals

Plans and quotas lists which plans include each feature. A search on a source that needs a plan feature your plan does not include returns 403. A lapsed license returns the same message on these eight sources:
Raw Leaks, Filtered Credentials, Raw Credentials, New Domain Registrations, Data Brokers and SSL Transparency Logs need only a license in force. Without one they return 403:
Over the per-second rate limit, any source returns 429 with {"message": "Rate limit exceeded", "retry_after_seconds": 1}. When the API Calls allowance is used up, the same body also carries limit, remaining and reset_at. No source has a monthly search allowance or a capacity limit, so no source returns 409 or a 429 with resource. Errors lists every error body.
Live searches are separate. Live Data Broker Search, Tor & I2P Network and Email References query their sources in real time instead of an index. They are covered under Live search.

​
Endpoints