Deep Web: The remainder of the internet that has not been indexed by search engines. Generally, it is accepted that about 95% of the internet is the deep web, while about 5% of the internet is the surface web.

Dark Web: A subset of the deep web, with two general characteristics: (1) they are websites that are not indexed by the major search engines and (2) they have to be accessed by using special software, methodologies, and related permission layers. Generally, it is understood that the Dark Web is used by social deviants, criminals, hackers, and other outliers.

Keywords and Phrases 

How to Search for 

Query String

One Term


Names or Words in Proximity

“Pat Smith”~2


“the quick brown fox”

Exact Words


This will bring in only the word “shoot”. If you do not include quotations, it will bring in shooting, shooters, etc.

Multiple terms, AND 

(hack AND password)

*Note: There is no NEAR operator*

Phone numbers 

“3031234567” OR “303-123-4567” OR “303 123 4567” OR “303.123.4567”

IP addresses 


Exclude words or parameters 



Emails, Cards, and SSNs 

How to Search for 

Query String 

Request Parameters 

All emails in a domain

Individual email addresses 


Credit cards 


Social security numbers 



How to Search for 

Query String 

Request Parameters 

Filter to a Domain

Including Information in Specific Fields

Please note that these fields will act as an AND to the entire query in the query box. However, if including multiple email addresses, CCNs, or SSNs, those will act as an OR to the others in the field. 

Query for Name and SSN or CCN

If you have exact SSNs and CCNs:

When building queries to uncover leaked SSNs and CCNs, it’s best practice to use the filters for SSN and CCN. Your query could look like: 

(“First and Last Name”~1) 

Then input the exact SSN and CCN in these boxes below the query 

Note: You do not need to include the hyphens when typing out CCN but you do need the hyphens in SSN. Keep in mind that while typing the numbers show up hashed for privacy reasons, so be careful and ensure you are typing the correct numbers. 

If you don’t have access to exact SSNs or CCNs:

Even if  you don’t have access to the exact SSNs or CCNs, you can select the boxes at the bottom of the Topic Builder. Numbers that are structured like an SSN or CCN will be included in results. 

Leaks, Groups, and Languages

Leaks: Refers to a known data leak that has been given a name or a leak tied to a specific company (i.e. Twitter, Houzz, Zynga). To limit the query to only return results within certain leaks, you can select the ones of interest.

Language: You can limit the query to only pull content containing certain languages. Within Feeds, you can continue to apply Google Translate on the posts. However within Topic Builder, this is a way to filter based on the language of the original post.

Groups:  Within Topic Builder, you can select content based on its Group (Chans, Blogs, Forums, etc). This can help narrow your queries to more specific subsets of data.

Key Sources Covered: 

  • AlternateDNS: an offshoot of clearnet, but doesn’t use traditional domain name resolution. So unlike a normal clearnet site that would query a DNS server to get the site’s IP address, this would refer to any system that resolves domain names another way. There are some criminal sites that operate under these alternate top level domains (.bazar for example is common for marketplaces). 

  • Discord: a VoIP, instant messaging and digital distribution platform. Users communicate with voice calls, video calls, text messaging, media and files in private chats or as part of communities called "servers". 

  • Ftp: File Transfer Protocol is a standard communication protocol used for the transfer of computer files from a server to a client on a computer network.

  • I2p: an anonymous peer-to-peer distributed communication layer designed to run any traditional internet service (e.g. Usenet, email, IRC, file sharing, Web hosting and HTTP, or Telnet), as well as more traditional distributed applications (e.g. a distributed data store, a web proxy network using Squid, or DNS)

  • Irc: Internet Relay Chat is a popular chat protocol. Can be connected to the Tor network to create an anonymous and secure chatroom, without the use of public IP addresses. 

  • Leak: selecting this as a source will run the query against the Dark Owl keyword list for leaks and leak sites. This leak list can be found here

  • Onion: a special-use top level domain name designating an anonymous onion service, which was formerly known as a "hidden service", reachable via the Tor network.

  • Telegram: a freeware, cross-platform, cloud-based instant messaging service. The service also provides end-to-end encrypted video calling, VoIP, file sharing and several other features. *we can get content from channels, not from individual users

  • Zeronet: a decentralized web-like network of peer-to-peer users, is built in Python; and is fully open source. Instead of having an IP address, sites are identified by a public key.

Dark Web Keywords 

Anarchist Keywords 

"Anti-government" OR anarchist OR anarchy OR "fuck the government" OR "fuck govement" OR anarchism OR "black-block" OR anarcho OR Marxist OR exact:mutualism OR "anti-authoritarians" OR anarch OR "green anarchist" OR "black anarchist" OR "anarchy2020" OR "antistate" OR "anti state"

Antifa Keywords 

"Anti Fascist Action" OR "Abolish Capitalism" OR "Smash fascism" OR smashfascism OR antifaschistisch OR "anti-fascist" OR antifascist OR "Antifaschistiske Aktion" OR "Direct action" OR "We go where they go" OR "WGWTG" OR "It's Going Down" OR "By Any Means Necessary" OR "BAMN" OR "Good night, alt-right" OR "Death to the Klan" OR PunchANazi OR "punch a nazi" OR "Redneck Revolt" OR "Refuse Fascism" OR "black bloc" OR blackbloc OR "snack bloc" OR snackbloc OR "Refuse Fascism" OR "Revolutionary Communist Party" OR RCP OR "John Brown Gun Club" OR "Rose City Antifa" OR rosecityantifa OR antifascism OR antifascista OR antifahooligans OR "antifa_anarchy" OR antifaanarchy OR antifascismo OR IamAntifascist OR antifa OR IAmAntifa OR "ash_antifa" OR Revolution2020 OR "ACAB" OR "All Cops Are Bastards" OR "Alt-Left" OR "International Socialism" OR Maoism OR "Anti-racist" OR Antiracist OR "Anti-capitalist" OR Anticapitalist

Boogaloo Keywords

Boogaloo OR "Big Luau" OR BigLuau OR "Big Igloo" OR BigIgloo OR Bigloo Bungaloo OR Boojahideen OR "Boog Buddies" OR BoogBuddy OR "Boog Bud" OR BoogBud OR Bungaluau OR Boogalorian OR Bungalorian OR Bungalore OR Boogfinity OR Boojahadeen OR Boojahedeen OR "Blue Igloo" OR BlueIgloo OR "Boog Sticks" OR BoogSticks OR "Duncan Lemp" OR "Socrates Lemp" OR "Virginia Knights" OR VirginiaKnights OR "State of Appalachia" OR BoogalooBois

Counterfeit Keywords 

"authorized seller" OR "brand name" OR "cheap price" OR "high quality" OR "knock off" OR "limited quantity" OR "looks exactly the same" OR "manufacturer's suggested retail price" OR "maximum retail price" OR "MRP" OR "MSRP" OR "OEM" OR "original equipment manufacturer" OR "original product" OR "serial number" OR affordable OR authentic OR clone OR "discount price" OR distributor OR fake OR genuine OR holograms OR imitation OR knockoff OR luxury OR replicas OR reseller OR wholesale

Credit Card Keywords 

ccn OR cvv OR expiration OR credit OR debit OR "card number" OR exact:fullz OR visa OR mastercard OR "american express" OR discover OR jcb OR "diners club" OR carding OR skimmed OR dump OR pin OR bin OR Карта

Crypto Tumbling Keywords 

mix OR laundry OR launder OR tumbler OR tumble OR "mixing services"

Drug Keywords 

acid OR pills OR meds OR marijuana OR cannabis OR fishscale cocaine OR meth OR pharm OR smoke OR weed OR grass OR 420 OR Heroin OR LSD OR blotters OR steroids OR "black rock" OR Prozac OR mdma OR pharma OR psychedelics OR cbd OR "anti-depressants" OR ecstasy OR benzos OR fentanyl OR opiods OR oxycotin OR "white lotus" OR "cinderella batch" OR COCAYINA OR Tryptamines OR Xanax OR buds OR amnesia OR "dutch haze" OR dexamphetamine OR kush OR dissociatives OR RCs OR 2CB OR stimulants OR barbiturates OR morphine OR shard OR ayahuasca OR peyote OR "san pedro" OR Viagra OR Promethazine OR codeine OR molly OR Alprazolam OR Somango OR Carisoprodol OR KETAMINE OR XTC OR tramadol OR lorazepam OR METHADONE OR KAMAGRA OR Cialis OR Etizolam OR Lidocaine OR Diazepam OR Vialium OR "blue punishers" OR Anastrazole OR Letrozole OR Clonazolam OR SuperPURESpeed OR BROMAZEPAM OR anadrol OR DMT OR Modafinil OR Zolpidem OR CLENBUTEROL OR Benzocaine OR "golden teacher" OR "Psilocybe Cubensis" OR Methylphenidate OR "Mexican gunpowder" OR Ritalin OR moonrocks OR Atorvastatin OR "Pregnyl HCG" OR Drostanolone OR Clomid OR Dihydocodeine OR Cenmox OR klonopin OR DICLAZEPAM

Hacking Keywords 

"0 day" OR 0day OR "CFW" OR "MITM" OR NAND OR "SDK" OR aslr OR backdoor OR bootloader OR botnet OR "brute force" OR bruteforce OR "buffer overflow" OR buffer* OR bypass OR chipset OR circumvent* OR clocking OR "code execution" OR crack OR crack* OR crash* OR "custom firmware" OR cve OR ddos OR "de-capsulation" OR decap OR decrypt* OR "developer account" OR dump* OR emulate OR encrypt* OR exact:bug OR exploit* OR firmware OR flash* OR flashcard OR flashcart OR "fuzz test" OR fuzzing OR glitch* OR hack OR hack* OR hax OR hijack OR homebrew OR "hot swapping" OR inject* OR jailbreak* OR kernel OR keylogger OR keyslot OR "keystroke logger" OR "man in the middle" OR "memory leak" OR "memory patches" OR metasploit OR modchip OR modification OR msfconsole OR overclock OR payload OR phish OR phishing OR rat OR "reverse engineer" OR "signature patches" OR sigpatch OR softmod OR "software development kits" OR timing OR trojan OR underclock OR unsigned OR userland OR vuln OR vulnerability OR warmboot OR webkit OR "zero day" OR zeroday

Insider Leak Indication Keywords 

"confidential document" OR "disgruntled employee" OR "information drop" OR "internal document" OR "little birdie" OR "non disclosure" OR "social engineering" OR informant OR NDA OR nondisclosure OR pretexting OR whistleblower

Legal Keywords 

"C&D" OR "cease & desist" OR "getting served" OR "got served" OR "internal counsel" OR "outside counsel" OR "take down" OR allegations OR appeal OR complaint OR defendant OR deposed OR depositions OR discovery OR evidence OR exact:sealed OR indictment OR lawsuit OR plaintiff OR pleadings OR proceedings OR settlement OR subpoenas OR sue OR takedown OR witnesses OR wrongdoings

Market Keywords 

market OR "for sale" OR escrow OR FE OR "finalize early" OR "vendor level" OR "trust level" OR selling OR "available for purchase" OR "to buy" OR fresh OR exchange OR store OR transaction

Piracy Keywords 

"PRE" OR "broken date" OR "early access" OR "early release" OR "scene release" OR "street date" OR crack* OR dupecheck

Protest Keywords 

protest OR protestors OR riot OR rioters OR teargas OR "tear gas" OR pepperspray OR "pepper spray" OR "pepper balls" OR "rubber bullets" OR "live rounds" OR grenade OR strike OR Antifa OR "anti-fa" OR fascist OR "anti-fascist" OR "donated to Trump" OR "black lives matter" OR BLM OR "all lives matter" OR dox OR revenge OR vengeance OR brutality OR vandalism OR activism OR activist OR "civil rights" OR KKK OR "white supremacy" OR "white supremacist" OR looting OR looters OR murder OR kill OR racism OR arrest OR bail OR boycott OR "civil disobedience" OR "national guard" OR military OR police OR "George Floyd" OR "Breanna Taylor" OR "" OR "meet up" OR meetup OR petition OR rally

QAnon Keywords 

"Red pilled" OR "red-pilled" OR "#WAKEUPAMERICA" OR "#FACTSMATTER" OR "#SAVEAMERICA" OR "#UNITEDNOTDIVIDED" OR "#WWG1WGA" OR "baking instructions" OR "learn to bake" OR breadcrumbs OR "bread crumbs" OR "where we go one, we go all" OR "the calm before the storm" OR "Q Research" OR "Qcode" OR "Q clocks" OR "Q Happenings" OR "QResearch" OR "QMap" OR "QPosts" OR "Great Awakening" OR "VINCIT OMNIA VERITAS" OR "SEMPER FIDELIS" OR "WWG1WGA" OR "Trumping the establishment" OR "q drop" OR "trust trump's plan"

Tutorial Keywords 

tutorial OR method OR "how to" OR guide OR instruction

Weapon Keywords 

gun OR pistol OR rifle OR grenade OR handgun OR shotgun OR sniper OR silencer OR revolver OR "full auto" OR "semi auto" OR (magazine AND clip) OR suppressor

Exclude Results - From Search Engine 

-(("OnionLand Search" AND "results found") OR title:("on tor66" OR "not Evil - Search Tor" OR "the deep searches" OR "visitor - tor hidden service search"))

Exclusion Terms - X Rated 

-("boy cp" OR "children porn" OR "young baby" OR "loli" OR "costumCP" OR "child" OR "child brothel" OR "cp for sale" OR "mother and son" OR "pedo" OR "youngest girl" OR "3dboys" OR "babyfan" OR "babyheart" OR "bayb heart" OR "beautyboys" OR "bestboy" OR "boy-lovers" OR "boychat" OR "boylove" OR "boylover" OR "boyteen" OR "boytor" OR "boyvids" OR "cheese pizza" OR "cheez pizza" OR "cheez pizza" OR "cheese pizza" OR "child love" OR "child porn" OR "child-lovers" OR "childchat" OR "childlove" OR "childplay" OR "childporn" OR "childsplay" OR "childwiki" OR "chronophilia" OR "confess to your father" OR "family love" OR "fast cp" OR "femaletorture" OR "germanchildren" OR "girl-lovers" OR "girland" OR "girlchat" OR "girllove" OR "girllover" OR "girls fucked" OR "hebephiles" OR "hotyoun" OR "hurtme" OR "jailbait" OR "kid rentals" OR "kids empire" OR "little rabbit hole" OR "pedo support community" OR "pedofile" OR "preeten" OR "preteen" OR "scream girls" OR "suggesteen" OR "taboo" OR "tabooless" OR "rape" OR "Педагогика" OR "lolita" OR "children sex" OR "alicedb" OR "girland" OR "lil heart" OR "nymph" OR "baby" OR "young girl")