> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search individual data sources

> Search one indexed data source at a time — 14 data sources, each with its own filters, result shape, and guide.

# Search individual data sources

A \*\*quick search\*\* fans one term out across every source at once. This does the opposite: you pick \*\*one\*\* data source and search it directly, on that source's own terms. Reach for it when you already know which source you want to dig into.

DarknetSearch indexes **14 data sources** you can search one at a time. Each has its own guide — what it searches, how to call it, and what comes back. Pick one from the grid below.

#### How a search runs

A source answers in one of two shapes:

* **Synchronous** — one call returns the findings in the response. Telegram, Discord, SSL Transparency Logs, Threat Actor Publications, and the indexed view of Credit Cards work this way.
* **Asynchronous** — the heavier sources run a background job. You **submit → poll → read**:

`POST` your search term to the source's create endpoint. It returns a task `id`.

`GET` the source's request endpoint by `id` until its `status` reports finished.

`GET` the source's result endpoint to page through the findings.

Every source is **free of credit cost**; each has its own daily rate limit, noted on its page. All calls take a bearer token — see [Authentication](https://github.com/kaduu-cti/darknetsearch-docs/blob/main/api/guides/authentication/README.md).

#### The data sources

The dumped content itself, with its file name, source leak, and tags — one row per matching record, nothing deduplicated. Deduplicated account rows — username, password, and server — each risk-scored and flagged by where it's used. Login, password, and website triples with their source leak — searchable by any field, no deduplication. Matching channel messages — text, channel, timestamp, attachments, and any links inside. Matching server messages — full text with the hit highlighted, plus author, channel, and server. Leaked profile posts — the matched profile text with its source forum, date, and thread metadata. Certificate records for your domain — the host, issuing CA, and validity — to surface certs you never asked for. Each short link resolved to its real destination, with file-extension and shortener facets to filter on. Exposed files with a direct URL and the bucket holding them, faceted by file category. Matching pastes — title, author, and a direct link, from the indexed archive or a live crawl. Matching app listings — the app's name, which store it's on, and a direct link to the page. Phishing URLs matching your brand — each with its PhishTank ID and community-verified status. Indexed card records by BIN or last 4, plus deep-web marketplace hits delivered as a downloadable file. Ransomware-victim listings — organizations named on leak sites, matched to your company or domain. \*\*Hacker Forums\*\*, \*\*Tor & I2P\*\*, and \*\*Social Media\*\* are real-time crawls, not indexed lookups — they're \[Live search]\(/api/guides/live-search) features, not data sources here.