Dark Web Search
Search the Dark Web on Demand.
Monitoring covers the identifiers you chose to watch. An incident brings new ones: a leaked mailbox, a wallet from a ransom note, a vendor’s email domain, a CVE your team is patching this week.
Dark Web Search queries Deepinfo’s dark web index directly, by phrase or by indicator, and returns each hit as the page it came from.
query {"email_apex": ["acme.example"]} POST /discovery/darkweb-search
- Results
- paste · crawled 2026-09-12 · hackishness 0.8 (the next pivot starts here)
- forum · crawled 2026-09-03 · hackishness 0.6
- Indicators on the page
- an email on acme.example
- a crypto address (the next pivot starts here)
- CVE-2021-44228
- Next query
- {"crypto_address": ["…"]}
Free Text Plus Extracted Indicators.
Free text matches a phrase in the page text. Indicators match the values the index extracts from each page, so a query for an email domain returns the pages where an address on that domain was extracted.
| Free text | text · Brand and product names, internal codenames, any phrase |
|---|---|
| Email address | email · One mailbox, such as an administrator account named in an incident |
| Email domain | email_ · Addresses on a domain, yours or a supplier’s |
| IP address | ip_ · Infrastructure named in a post, whether it is yours or an attacker’s |
| Crypto address | crypto_ · A wallet from a ransom note or an extortion post |
| Card number | ccn · Payment card numbers posted or offered for sale |
| CVE | cve · Discussion of a vulnerability on your patch list |
| Social Security number | ssn · Identity records in leaked datasets |
| Website mention | website_ · Pages that name one of your sites |
| Data leak | data_ · Posts tied to a named leak |
Narrow the Query to the Right Sources.
An investigation is usually about one kind of place and one window of time. The filters say which.
Where
Source Filters
Restrict a query by source type, source group or source domain, or to individual chat channels. Useful when the question is about one market or one forum.
When
Crawl Date and Post Date
Filter on when a page was crawled or when it was posted. That separates this week’s chatter from an old dump that has resurfaced.
Signal
Hackishness
Each result carries a hackishness score between 0 and 1, and a query can filter on a range of it. Raise the floor when a common brand name returns too much noise.
Every Hit Comes Back With Context.
Each result is a page: its title, a snippet around the match, the URL and the source domain, typed as forum, market, paste, leak, chat or IRC.
The result also lists the other indicators the index extracted from that page. An address found next to yours, or a wallet in the same post, is usually the next query.
- Title, snippet and URL
- Source domain and source type
- Crawl date and hackishness score
- Emails, IPs, crypto addresses, CVEs and websites found on that page
- Card numbers and Social Security numbers, where the page lists them
curl -X POST \
"https://api.deepinfo.com/v1/discovery/darkweb-search?page=1" \
-H "apikey: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"email_apex": ["acme.example"]}'When to Run a Search.
Incident Triage
An address, a wallet or an IP turns up in an investigation. Check whether it appears anywhere in the index before deciding how far the incident reaches.
Threat Hunting
Pivot from one indicator to the pages it appears on, then from those pages to the other indicators they contain.
Extortion and Ransomware
Search a leak name or the crypto address from a ransom note to see where else it has been posted.
Supplier Checks
Search a supplier’s email domain and website before an onboarding decision, or after they report an incident.
Query This Data Through the API
Credentials and dark web findings stay in the platform. The domain and vulnerability data around them is open through the API.
Questions About Dark Web Search
Which sources does the dark web index cover?
Forums, markets, paste sites, chats and leak sites. Each result is typed by where it came from: forum, market, paste, leak, chat or IRC.
How is Dark Web Search different from Dark Web Mentions Monitoring?
Search answers a question an analyst has right now. Mentions Monitoring keeps the question open for your organization’s identifiers without anyone running a query. Both read the same index.
Can one query check several indicators?
Yes. Each indicator takes a list of values, and free text, indicators and source filters can share one request. At least one of them is required.
Does an empty result mean the indicator never leaked?
It means the indicator wasn’t found in the sources Deepinfo indexes. Dark web coverage is partial by nature, as the methodology states, so weigh an empty result with your other evidence.
Can we run dark web searches from our own code?
Yes. Dark web search is an endpoint in the Deepinfo API, POST /, which takes the query fields and filters on this page and returns results page by page. The Darkweb Search reference lists all the fields.
Bring Your Identifiers. We’ll Build the Queries.
Book a demo and bring the domains, email domains, wallets or CVEs your team cares about. We’ll walk through how to query each one and what a result carries.