Skip to main content
A quick search fans one term out across every source at once. This does the opposite: you pick one data source and search it directly, on that source’s own terms. Reach for it when you already know which source you want to dig into.
DarknetSearch indexes 15 data sources you can search one at a time. Each has its own guide — what it searches, how to call it, and what comes back. Pick one from the grid below.

​
How a search runs

A source answers in one of two shapes:
  • Synchronous — one call returns the findings in the response. Telegram, Discord, SSL Transparency Logs, Threat Actor Publications, and the indexed view of Credit Cards work this way.
  • Asynchronous — the heavier sources run a background job. You submit → poll → read:
1

Submit

POST your search term to the source’s create endpoint. It returns a task id.
2

Poll

GET the source’s request endpoint by id until its status reports finished.
3

Read

GET the source’s result endpoint to page through the findings.
Every source is free of credit cost; each has its own daily rate limit, noted on its page. All calls take a bearer token — see Authentication.

​
The data sources

Raw Leaks

The dumped content itself, with its file name, source leak, and tags — one row per matching record, nothing deduplicated.

Filtered Credentials

Deduplicated account rows — username, password, and server — each risk-scored and flagged by where it’s used.

Raw Credentials

Login, password, and website triples with their source leak — searchable by any field, no deduplication.

Telegram

Matching channel messages — text, channel, timestamp, attachments, and any links inside.

Discord

Matching server messages — full text with the hit highlighted, plus author, channel, and server.

New Domain Registrations

Domains registered in the last days across 12 feeds — the window between a look-alike being registered and the campaign going live.

Data Brokers

Leaked profile posts — the matched profile text with its source forum, date, and thread metadata.

SSL Transparency Logs

Certificate records for your domain — the host, issuing CA, and validity — to surface certs you never asked for.

URL Shorteners

Each short link resolved to its real destination, with file-extension and shortener facets to filter on.

Open Cloud Storage

Exposed files with a direct URL and the bucket holding them, faceted by file category.

Data Pastes

Matching pastes — title, author, and a direct link, from the indexed archive or a live crawl.

App Store Monitoring

Matching app listings — the app’s name, which store it’s on, and a direct link to the page.

Phishing References

Phishing URLs matching your brand — each with its PhishTank ID and community-verified status.

Credit Cards

Indexed card records by BIN or last 4, plus deep-web marketplace hits delivered as a downloadable file.

Threat Actor Publications

Ransomware-victim listings — organizations named on leak sites, matched to your company or domain.
Hacker Forums, Tor & I2P, and Social Media are real-time crawls, not indexed lookups — they’re Live search features, not data sources here.