The Shadowspotter query language

Shadowspotter uses a domain-specific query language called ShadowLang. The syntax is intentionally close to VirusTotal's query language and to Kibana's KQL, so if you are familiar with either you should feel at home. The same syntax is used in the search bar and when defining a detection.

Anatomy of a query

A query is a sequence of field:value conditions, optionally scoped to an entity:

entity:whois registrar:*NameCheap* creation_date:2024-01-01+

You can omit entity: entirely — Shadowspotter infers the entity from the fields you use:

registrar:*NameCheap* creation_date:2024-01-01+

Syntax rules

• Field and value are separated by a colon — field:value.
• AND is implicit. Two adjacent conditions are combined with AND. Write OR explicitly when you need it.
• NOT negates the condition that immediately follows. To negate a group, wrap it in parentheses: NOT (a:1 OR b:2).
• Wildcards — * matches any string. It can appear at the beginning or end of a value (e.g. domain:*.example.com or title:'Login*'). Wildcards in the middle of a word are not supported.
• Quoting — values containing spaces or punctuation must be quoted with single or double quotes: registrar:'NameCheap, Inc.'.
• Ranges — for numeric and date fields, append + for "greater or equal" and - for "less or equal". Examples: creation_date:2024-01-01+, port:443-.
• Dates — YYYY-MM-DD or YYYY-MM-DD HH:MM.
• Regular expressions — prefix the value with ~ to match using a regex: title:~'^Login( page)?$'.
• Multi-entity queries — to combine fields from different entities, wrap each entity block in parentheses:

  (entity:whois registrar:'NameCheap, Inc.' domain:shadow*) AND (entity:dns ns_record:*.dreamhost.com.)

  Multi-entity queries require a paid subscription.

Search time range

For WHOIS searches, the time picker (and the API's start_date/end_date) limits observation history in both simple and advanced search. Records are included when their first-seen/last-seen interval overlaps the selected window, regardless of when the domain was registered. This applies equally to exact domains, wildcards, registrars, and other WHOIS filters. Results reflect recorded observations, not a live check of whether a domain is still registered.

To search by registration age, use an explicit creation_date condition in advanced search. For example, entity:whois domain:*.com creation_date:2026-09-01+ finds domains registered on or after September 1, 2026 whose WHOIS observations overlap the selected window. The observation history available still depends on your subscription.

Entities

Every query targets one of these entities. If you do not write entity: explicitly, Shadowspotter picks one based on the fields used.

Fields by entity

Domain

WHOIS

DNS

Certificate

HTTP

Public IOCs

IOC conditions in one block match the same evidence record. Join an IOC block with other entities to correlate listings with stored observations. Domain and certificate joins respect the feed's exact-domain or descendant scope; WHOIS joins match the domain's apex registration. DNS joins also match listed IPv4 and IPv6 addresses in A/AAAA answers, and HTTP joins match listed endpoint IPs. IP allocation joins match listed addresses contained in the allocation.

These searches use the latest successful feed listings. They do not establish whether an IOC was listed when a historical DNS or HTTP observation occurred. The time picker limits the main observation entity, or the latest confirmation for standalone IOC searches. Joined results keep listing dates as ioc_first_seen/ioc_last_seen; the listing history link shows earlier episodes. IOC queries are available in interactive search, but cannot be saved as detections.

URL feed records also return original_url, preserving the full reported URL. Use Analyze URL / take screenshot to prefill URL Analysis with its path and query string. PhishDB URL evidence is searchable as text, for example entity:ioc source:phishdb metadata:*login*.

Examples

Subdomains of a known apex domain

entity:domain domain:*.google.com

Newly registered domains via a specific registrar on Cloudflare

entity:whois registrar:*WEBCC* name_server:*.cloudflare.com creation_date:2024-07-01+

Recent ZeroSSL certs, excluding the www subdomain

entity:cert issuer:*ZeroSSL* seen:2024-08-01+ NOT domain:www.*

Domains pointing to a specific A record

entity:dns a_record:142.250.203.* domain:*.ch

Pages whose title mentions a brand on a domain that isn't theirs

entity:http title:'*Swisscom*' NOT domain:*.swisscom.ch NOT domain:swisscom.ch

Look-alike domains registered recently

entity:whois fuzzy_domain:amazon.com creation_date:2024-09-01+

Multi-entity: WHOIS + DNS together

(entity:whois registrar:'NameCheap, Inc.' domain:shadow*) AND (entity:dns ns_record:*.dreamhost.com.)

Rösti listings whose evidence mentions C2

entity:ioc source:rosti metadata:*C2*

DNS observations matching public domain or IP listings

(entity:dns domain:*.example.com) AND (entity:ioc source:rosti)

HTTP endpoints associated with public IOCs

(entity:http title:*Login*) AND (entity:ioc label:*phish*)

Listed IPs within Swiss allocations

(entity:ip country:CH) AND (entity:ioc value:*)