Search syntax

Plain words work. These rules help you narrow down.

The basics

  • Several words must all be present: acme invoice means “acme” and “invoice”.
  • Exact phrase: put it in quotes, "purchase order".
  • Either word: contract OR invoice. Write OR in capitals.
  • Exclude a word: put a minus sign in front of it, acme -test.
  • Word start: end a word with *, ransom*.
Examples 
acme.example
"Acme Industries" invoice
contract OR "purchase order"
acme.example -test -demo
ransom*

Domains, emails, IP addresses and file names

A domain, an email address, an IP address or a file name is searched as an exact phrase, with no quotes needed. acme.example finds that domain, not documents that contain “acme” and “example” somewhere.

No parentheses

Parentheses do not group words. Write contract OR invoice, not (contract OR invoice). To combine two ideas, run two searches.

Field filters

Field filters such as url:, file: and title: aren’t available on Access. You can still filter by channel (level0:) and by date. Write dates as YYYY-MM-DD. Channels include ransomware, forum, marketplace and paste.

Examples 
acme.example level0:ransomware
acme.example date:>=2024-01-01
acme.example date:[2024-01-01 TO 2024-12-31]

Tips

  • Start with your company name or domain plus one more word.
  • Too many results? Add a word. None? Remove one.
  • Each distinct query counts once in your week. Limits.