urlquery Search Guide

Search urlquery analysis reports using structured fields, boolean expressions, wildcards, ranges, hashes, or captured page content.

Search covers:

• Report metadata
• Submitted and final URLs
• Network and HTTP activity
• IP and ASN information
• Extracted files and artifacts
• File hashes
• Tags
• TLS certificate metadata
• Captured HTML
• JavaScript content

Results are ordered by report date, newest first. Search covers reports from the last year; a date range in the query narrows that window.

Each result contains only a report overview. Fetch the report by its ID for the evidence. With MCP, use compact get_report for triage, get_report with view=full for a broad bounded snapshot, and focused report tools for complete paginated evidence.

Search Syntax

Field Search

Use field:value to search structured report data.

tags:phishing
url.domain:example.com
ip.addr:8.8.8.8

Prefer field searches whenever the value belongs to a known field.

Boolean Operators

Combine clauses using uppercase AND, OR, and NOT.

tags:phishing AND url.tld:xyz
tags:phishing OR tags:scam
tags:phishing AND NOT ip.country_code:US

Use parentheses to control grouping.

(tags:phishing OR tags:scam) AND url.tld:xyz

A field can also contain a grouped expression:

tags:(phishing OR scam)

Default Matching

Multiple unquoted terms are normally treated as an AND search.

login portal

is equivalent to searching for content containing both terms.

Use explicit boolean operators for complex queries.

Exact Phrases

Wrap text in double quotes when words must appear together and in order.

"Logo loader"
final.title:"Sign in"
http.response.raw:"Apache"

Wildcards

Use * to match unknown text.

url.addr:*login*
artifacts.files.archive.filename:*.php

A leading wildcard is supported but may be slower.

Wildcards work inside field:value clauses. A single term without a field, such as *login*, is matched as an exact phrase instead.

Use field:* to find reports containing a value for that field.

artifacts.telegram.token:*

Prefer exact values over broad wildcard searches when possible.

Ranges

Use square brackets for inclusive date or numeric ranges.

date:[2026-05-01 TO 2026-05-09]

A date range is how you narrow the search window. The HTTP API has no separate date parameters, and MCP search tools add a date range from their start_date and end_date arguments. A range that starts more than a year ago still only finds reports from the last year.

http.security_info.cert.validity.end:[2026-01-01 TO 2026-02-03]

http.response.data.size:[1000 TO 100000]

Hashes

A lowercase MD5, SHA-1, SHA-256, or SHA-512 hash that is the whole query is looked up in HTTP response bodies, JavaScript, extracted files, and files inside archives.

44d88612fea8a8f36de82e1278abb02f

The shortcut does not apply when the hash is combined with other terms, including the date range MCP tools add, or when it is not lowercase. Use a specific hash field in those cases, and when the location of the hash matters, for example for PDFs or Windows shortcuts.

A bare IP address is likewise searched as http.ip.addr.

artifacts.files.sha256:<sha256>
http.response.data.sha256:<sha256>

Content Search

Plain text and quoted phrases search the report fields and captured:

• HTML documents
• JavaScript resources

Examples:

"<title>AOL</title>"
"Logo loader"

Content searches can be combined with structured fields:

"Logo loader" AND tags:phishing

Plain-text searches do not search the contents of every downloaded file.

Field Reference

General Report Fields

Field	Description
date	Report generation date
tags	Tags applied by urlquery
submit.tags	Tags assigned during submission
url.addr	Submitted URL without http:// or https://
url.domain	Domain of the submitted URL
url.fqdn	FQDN of the submitted URL
url.tld	TLD of the submitted URL
ip.addr	IP associated with the submitted URL
ip.country_code	ISO country code
ip.country	Country name
ip.as	Autonomous System organization
ip.asn	Autonomous System Number
final.url.addr	Final URL after redirects
final.url.domain	Final domain after redirects
final.url.fqdn	Final FQDN after redirects
final.url.tld	Final TLD after redirects
final.title	Final webpage title

HTTP Fields

Field	Description
http.url.addr	Full URLs observed during analysis
http.url.domain	Domains observed in HTTP traffic
http.url.fqdn	FQDNs observed in HTTP traffic
http.url.tld	TLDs observed in HTTP traffic
http.ip.addr	IPs observed during HTTP requests
http.ip.country_code	ISO country code for HTTP IPs
http.ip.country	Country for HTTP IPs
http.ip.as	Autonomous System organization
http.ip.asn	Autonomous System Number
http.request.method	Captured HTTP request method
http.request.raw	Stored raw request header capture
http.request.post_data.size	Recorded captured request-data size
http.request.post_data.data	Captured POST, PUT, or other request data
http.response.raw	Stored raw response header capture
http.response.data.magic	Detected response file type
http.response.data.size	Response body size
http.response.data.md5	MD5 hash of response body
http.response.data.sha1	SHA-1 hash of response body
http.response.data.sha256	SHA-256 hash of response body
http.response.data.sha512	SHA-512 hash of response body
http.security_info.cert.validity.start	TLS certificate validity start
http.security_info.cert.validity.end	TLS certificate expiry

Extracted File Fields

Field	Description
artifacts.files.md5	File MD5 hash
artifacts.files.sha1	File SHA-1 hash
artifacts.files.sha256	File SHA-256 hash
artifacts.files.sha512	File SHA-512 hash
artifacts.files.magic	Detected file type
artifacts.files.alerts.analyzer.alert	Analyzer alerts

Archive Fields

Field	Description
artifacts.files.archive.md5	Archived file MD5 hash
artifacts.files.archive.sha1	Archived file SHA-1 hash
artifacts.files.archive.sha256	Archived file SHA-256 hash
artifacts.files.archive.sha512	Archived file SHA-512 hash
artifacts.files.archive.magic	Archived file type
artifacts.files.archive.filename	Archived filename
artifacts.files.archive.path	Archived file path
artifacts.files.archive.alerts.analyzer.alert	Analyzer alerts for archived files

PDF Document Fields

Field	Description
artifacts.pdfs.md5	PDF MD5 hash
artifacts.pdfs.sha1	PDF SHA-1 hash
artifacts.pdfs.sha256	PDF SHA-256 hash
artifacts.pdfs.sha512	PDF SHA-512 hash
artifacts.pdfs.magic	PDF file type
artifacts.pdfs.size	PDF size
artifacts.pdfs.url.addr	URL that delivered the PDF
artifacts.pdfs.url.domain	Domain that delivered the PDF
artifacts.pdfs.url.fqdn	FQDN that delivered the PDF
artifacts.pdfs.url.tld	TLD that delivered the PDF
artifacts.pdfs.extracted_urls.url.addr	URL extracted from a PDF
artifacts.pdfs.extracted_urls.url.domain	Domain extracted from a PDF
artifacts.pdfs.extracted_urls.url.fqdn	FQDN extracted from a PDF
artifacts.pdfs.extracted_urls.url.tld	TLD extracted from a PDF
artifacts.pdfs.meta.author	PDF author metadata
artifacts.pdfs.meta.title	PDF title metadata
artifacts.pdfs.meta.creator	PDF creator metadata
artifacts.pdfs.meta.producer	PDF producer metadata
artifacts.pdfs.alerts.analyzer.alert	Analyzer alerts for PDFs

Windows Shortcut Fields

Field	Description
artifacts.windows_shortcuts.md5	Shortcut MD5 hash
artifacts.windows_shortcuts.sha1	Shortcut SHA-1 hash
artifacts.windows_shortcuts.sha256	Shortcut SHA-256 hash
artifacts.windows_shortcuts.sha512	Shortcut SHA-512 hash
artifacts.windows_shortcuts.magic	Shortcut file type
artifacts.windows_shortcuts.size	Shortcut size
artifacts.windows_shortcuts.url.addr	URL associated with shortcut
artifacts.windows_shortcuts.url.domain	Domain associated with shortcut
artifacts.windows_shortcuts.url.fqdn	FQDN associated with shortcut
artifacts.windows_shortcuts.url.tld	TLD associated with shortcut
artifacts.windows_shortcuts.string_data.command_line_arguments	LNK command-line arguments

Telegram Fields

Field	Description
artifacts.telegram.token	Extracted Telegram token
artifacts.telegram.is_revoked	Whether the token is revoked
artifacts.telegram.bot.token	Telegram bot token
artifacts.telegram.bot.user_id	Telegram bot user ID
artifacts.telegram.bot.username	Telegram bot username
artifacts.telegram.bot.first_name	Telegram bot first name
artifacts.telegram.bot.last_name	Telegram bot last name
artifacts.telegram.bot.chat.chat_id	Telegram chat ID
artifacts.telegram.bot.chat.title	Telegram chat title
artifacts.telegram.bot.chat.type	Telegram chat type
artifacts.telegram.bot.chat.bot_is	Bot-related chat information
artifacts.telegram.bot.chat.total_users	Number of users in the chat
artifacts.telegram.bot.pending_messages	Number of pending messages

Clipboard Fields

Field	Description
artifacts.clipboard.source	Clipboard observation source
artifacts.clipboard.content	Captured clipboard content

Query Examples

Tagged Reports

tags:tycoon

Submitted Domain

url.domain:example.com

Suspicious TLD

url.tld:xyz

Resolved IP

ip.addr:8.8.8.8

HTTP Domain

http.url.domain:example.com

URL Path Fragment

url.addr:*login*

Archive Filename

artifacts.files.archive.filename:*.php

Extracted PDF

artifacts.files.magic:"PDF"

Telegram Token Present

artifacts.telegram.token:*

Response Header

http.response.raw:"Apache"

TLS Certificate Expiry

http.security_info.cert.validity.end:[2026-01-01 TO 2026-02-03]

HTML or JavaScript Phrase

"Logo loader" AND tags:phishing

Phishing Reports in a Date Range

(tags:phishing OR tags:scam) AND date:[2026-05-01 TO 2026-05-09]

Campaign on a Specific Domain

tags:phishing AND final.url.domain:example.com

Search Strategy

When constructing a query:

1. Prefer exact hashes, domains, IPs, tags, or other structured fields.
2. Add additional fields with AND to narrow large result sets.
3. Use date ranges for high-volume searches.
4. Use quoted content searches when looking for HTML or JavaScript text.
5. Use wildcards only when an exact value is not known.
6. Avoid broad leading-wildcard or content searches unless necessary.
7. Open a relevant result by its report ID for the evidence. With MCP, use compact get_report, then report_guide and focused report tools for the evidence the investigation needs.

Limits

Visibility

Search only returns reports visible to the current account:

• Public reports
• Restricted reports, when the account's plan includes restricted report access
• Reports submitted by the account or its team

Content Scope

Plain-text search covers report fields and captured HTML and JavaScript content. It does not search every byte of every downloaded file.

The HTML and JavaScript part of a content search matches at most 1000 captured documents per type, seen within the last 12 months. Common phrases can therefore miss reports; combine them with structured fields.

Time Window And Page Size

Search covers the last year. A date range in the query narrows it but cannot reach older reports.

Interface	Page size	Paging
HTTP API	limit 1 to 100, default 25	offset up to 10000, and offset plus limit at most 10000
MCP search tools	limit up to 25, default 10	See the tool reference

HTTP API queries can be up to 8192 characters.

Wildcard Cost

Broad wildcard searches, especially leading wildcards, can be slower.

Prefer exact domains, hashes, tags, IPs, and date ranges whenever possible.

Timeouts

Very broad or expensive searches may return partial results if the search timeout is reached.

Complex URLs

When a full URL is difficult to express as a query, search using its domain, path fragment, hash, or an exact phrase instead.