Nord Security

Nord Security Dark Web Intelligence API

Endpoints for searching scraped content from the dark web

Documentation GitHub OpenAPI

Operations 6

POST /scraped-content/forum Scraped forum content search #

POST /scraped-content/telegram Scraped Telegram content search #

POST /scraped-content/ransomware Scraped ransomware content search #

POST /scraped-content/marketplace Scraped marketplace content search #

POST /scraped-content/tags Scraped content tags lookup #

POST /scraped-content/screenshot Scraped content screenshot lookup #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/nord-security-dark-web-intelligence-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: NordStellar Enterprise Data Dark Web Intelligence API
  description: '## Overview

    The NordStellar Enterprise Data API provides comprehensive access to our data breach intelligence platform, enabling organizations to integrate real-time security monitoring and alerting capabilities directly into their existing infrastructure.

    This API allows you to proactively protect your users by detecting when their sensitive information has been compromised in data breaches across the internet.


    **Key Features**:

    - **Real-time Breach Monitoring**: Receive immediate notifications when user data appears in newly discovered data breaches.

    - **Zero-Knowledge Architecture**: Search for compromised sensitive data (credit cards, national identification numbers) using secure hash-based methods that never transmit the actual sensitive information.

    - **Comprehensive Data Sources**: Access intelligence from multiple sources including corporate data breaches, malware infection logs, and stolen credential lists.

    - **Flexible Integration Options**: Support for webhook notifications, bulk operations, and subscription management to fit your organization''s unique requirements.

    - **Enterprise-Grade Security**: Secure authentication methods, rate limiting, and quota management to ensure responsible and controlled API usage.'
  version: '3.1'
servers:
- url: /api/v3/data
security:
- ApiKeyAuth: []
- BasicAuth: []
tags:
- name: Dark Web Intelligence
  description: Endpoints for searching scraped content from the dark web
paths:
  /scraped-content/forum:
    post:
      tags:
      - Dark Web Intelligence
      summary: Scraped forum content search
      description: 'This endpoint allows users to search through scraped forum content found on the dark web using a Lucene query as the main search query.

        It provides a powerful and flexible search capability by allowing users to construct complex queries to filter and retrieve specific forum content.


        **Example Lucene Query:**

        - To search for posts with the word "malware" in the content field, authored by "john doe":


        `content:malware AND author_name:"john doe"`


        Search phrases can be optionally highlighted in the search results using the `highlight_params` object.

        All keywords that are matched by the query will be wrapped with passed starting and ending tags.


        The endpoint can return a maximum of 10,000 records. An offset plus limit that exceeds 10,000 will result in a bad request


        **Rate limit: 50 per second.**'
      operationId: forumSearch
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ForumSearchRequest'
      responses:
        '200':
          description: Returns a list of forum threads
          headers:
            X-RateLimit-Limit:
              schema:
                type: integer
              description: Request limit per second. Defaults 200 per second
            X-RateLimit-Remaining:
              schema:
                type: integer
              description: The number of requests left for the time window.
            X-RateLimit-Reset:
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForumSearchResponse'
              examples:
                forumPosts:
                  summary: Example of a forum thread search response
                  value:
                    data:
                    - id: 6715e928a3dd3128e8a357b4
                      content:
                        title: A SMALL PART OF THE LYCA MOBILE SYSTEM (UK)
                        content: 'WE ADMIT THAT WE HAVE ATTACKED AND STAYED IN THE LYCA MOBILE COMPANY SYSTEM FOR A YEAR. THE COMPANY HAS FRAUDULENT CARD INFORMATION SECURITY BY ONLY EXPOSING THE LAST 4 DIGITS OF CUSTOMERS'' CARDS WHILE WE HAVE CONSUMED MORE THAN 2 MILLION CREDIT CARDS WITH FULL USER INFORMATION DOWNLOAD: https://example.com/Information/some-file-1.csv

                          https://example.com/Information/some-file-2.csv'
                        extracted_links:
                        - https://example.com/Information/some-file-2.csv
                        author_name: KryptonZambie
                        author_url: https://breachforums.st/User-KryptonZambie
                        date_posted: '2024-10-20T11:14:00Z'
                        url: https://breachforums.st/Thread-DATABASE-A-SMALL-PART-OF-THE-LYCA-MOBILE-SYSTEM-UK
                        onion_url: http://breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion/Thread-DATABASE-A-SMALL-PART-OF-THE-LYCA-MOBILE-SYSTEM-UK
                      metadata:
                        tags:
                        - DATABASE
                        - TOP_5000_CF
                        date_scraped: '2024-10-21T05:39:52Z'
                      target_data:
                        site_url: https://breachforums.st
                        site_domain_name: breachforums.st
                        site_subdomain_url: Forum-Databases
                        onion_domain_name: breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion
                    - id: 67111ac33311a66e3bd0b195
                      content:
                        title: OVER 110GB OF DRIVER'S LICENSE AND BANK STATEMENTS FROM CMELITEGROUP.COM USERS (USA)
                        content: 'Date Of Leak : 26-09-2024 Website: https://www.example-company.com/ ALL IDENTIFICATION DOCUMENTS AND BANK STATEMENTS OF THE AMERICAN STOCK EXCHANGE SYSTEM CMELITEGROUP.COM SAMPLE: https://example.com/Information/some-file-3.zip Hidden Content'
                        extracted_links:
                        - https://example.com/Information/some-file-3.zip
                        - https://www.example-company.com/
                        author_name: KryptonZambie
                        author_url: https://breachforums.st/User-KryptonZambie
                        date_posted: '2024-10-17T13:51:11Z'
                        url: https://breachforums.st/Thread-DATABASE-OVER-110GB-OF-DRIVER-S-LICENSE-AND-BANK-STATEMENTS-FROM-CMELITEGROUP-COM-USERS-USA
                        onion_url: http://breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion/Thread-DATABASE-OVER-110GB-OF-DRIVER-S-LICENSE-AND-BANK-STATEMENTS-FROM-CMELITEGROUP-COM-USERS-USA
                      metadata:
                        tags:
                        - DATABASE
                        - TOP_50000_CF
                        date_scraped: '2024-10-17T14:10:11Z'
                      target_data:
                        site_url: https://breachforums.st
                        site_domain_name: breachforums.st
                        site_subdomain_url: Forum-Databases
                        onion_domain_name: breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion
                    - id: 67124fd618588a5f28bbd1d9
                      content:
                        title: OVER 110GB OF DRIVER'S LICENSE AND BANK STATEMENTS FROM CMELITEGROUP.COM USERS (USA)
                        content: 'Date Of Leak : 26-09-2024 Website: https://www.example-company.com/ ALL IDENTIFICATION DOCUMENTS AND BANK STATEMENTS OF THE AMERICAN STOCK EXCHANGE SYSTEM CMELITEGROUP.COM SAMPLE: https://example.com/Information/some-file-3.zip Hidden Content You must reply to this thread to view this content.'
                        extracted_links:
                        - https://example.com/Information/some-file-3.zip
                        - https://www.example-company.com/
                        author_name: KryptonZambie
                        author_url: https://breachforums.st/User-KryptonZambie
                        date_posted: '2024-10-17T13:49:00Z'
                        url: https://breachforums.st/Thread-OVER-110GB-OF-DRIVER-S-LICENSE-AND-BANK-STATEMENTS-FROM-CMELITEGROUP-COM-USERS-USA
                        onion_url: http://breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion/Thread-OVER-110GB-OF-DRIVER-S-LICENSE-AND-BANK-STATEMENTS-FROM-CMELITEGROUP-COM-USERS-USA
                      metadata:
                        tags:
                        - DATABASE
                        - TOP_50000_CF
                        date_scraped: '2024-10-18T12:08:54Z'
                      target_data:
                        site_url: https://breachforums.st
                        site_domain_name: breachforums.st
                        site_subdomain_url: Forum-Databases-Removed-Content
                        onion_domain_name: breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion
                    - id: 67111ac43311a66e3bd0b197
                      content:
                        title: 152GB PHILIPPINE ID CARD (WITH PHONE NUMBERS OF MORE THAN 4 MILLION PEOPLE )
                        content: '152GB PHILIPPINES ID CARD (INCLUDING PHONE NUMBERS OF MORE THAN 4 MILLION PEOPLE) SAMPLE: https://example.com/Information/some-file-4.rar Hidden Content

                          https://example.com/Information/some-file-4.rar'
                        extracted_links:
                        - https://example.com/Information/some-file-4.rar
                        author_name: KryptonZambie
                        author_url: https://breachforums.st/User-KryptonZambie
                        date_posted: '2024-10-17T13:36:12Z'
                        url: https://breachforums.st/Thread-DATABASE-152GB-PHILIPPINE-ID-CARD-WITH-PHONE-NUMBERS-OF-MORE-THAN-4-MILLION-PEOPLE
                        onion_url: http://breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion/Thread-DATABASE-152GB-PHILIPPINE-ID-CARD-WITH-PHONE-NUMBERS-OF-MORE-THAN-4-MILLION-PEOPLE
                      metadata:
                        tags:
                        - CARD
                        - PHOTO
                        - TOP_10000_CF
                        - TOP_5000_CF
                        date_scraped: '2024-10-17T14:10:12Z'
                      target_data:
                        site_url: https://breachforums.st
                        site_domain_name: breachforums.st
                        site_subdomain_url: Forum-Databases
                        onion_domain_name: breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion
                    total_results: 30
        '206':
          description: Returns a list of forum threads (Partial content if response would exceed 4MB)
          headers:
            X-RateLimit-Limit:
              schema:
                type: integer
              description: Request limit per second. Defaults 200 per second
            X-RateLimit-Remaining:
              schema:
                type: integer
              description: The number of requests left for the time window.
            X-RateLimit-Reset:
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForumSearchResponse'
        '400':
          description: Bad request (Indicates incorrect / missing values)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '422':
          description: Unprocessable Entity (Indicates invalid Lucene query)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - ApiKeyAuth: []
  /scraped-content/telegram:
    post:
      tags:
      - Dark Web Intelligence
      summary: Scraped Telegram content search
      description: 'This endpoint allows users to search through scraped Telegram content found on the variety of channels in Telegram Ecosystem using a Lucene query as the main search query.

        It provides a powerful and flexible search capability by allowing users to construct complex queries to filter and retrieve specific telegram content.


        **Example Lucene Query:**

        - To search for messages with the word "malware" in the content field, authored by "john doe":


        `content:malware AND author_name:"john doe"`


        Search phrases can be optionally highlighted in the search results using the `highlight_params` object.

        All keywords that are matched by the query will be wrapped with passed starting and ending tags.


        The endpoint can return a maximum of 10,000 records. An offset plus limit that exceeds 10,000 will result in a bad request


        **Rate limit: 50 per second.**'
      operationId: telegramSearch
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TelegramSearchRequest'
        required: true
      responses:
        '200':
          description: Returns a list of telegram messages
          headers:
            X-RateLimit-Limit:
              schema:
                type: integer
              description: Request limit per second. Defaults 200 per second
            X-RateLimit-Remaining:
              schema:
                type: integer
              description: The number of requests left for the time window.
            X-RateLimit-Reset:
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TelegramSearchResponse'
              examples:
                telegramMessages:
                  summary: Example of a telegram message search response
                  value:
                    data:
                    - id: 6841b62e41c5cf44ee3ffa94
                      content:
                        title: 'REvil-Ransomware | Announcement #101'
                        content: 'We are back! REvil ransomware group is recruiting new affiliates for high-profile targets. Contact us for partnership. #Ransomware #REvil'
                        author_name: REvilOfficial
                        external_author_id: 1234567890
                        date_posted: '2025-06-05T15:12:32Z'
                        url: https://t.me/c/1234567890/101
                      metadata:
                        tags:
                        - RANSOMWARE
                        - MALWARE
                        date_scraped: '2025-06-05T15:22:24Z'
                      target_data:
                        external_channel_id: 1234567890
                        channel_name: REvil Official Announcements
                        channel_identifier: REvilOfficial
                    - id: 6841b75fd77610afbeff7a0b
                      content:
                        title: 'ShadowMarket | Sale #554'
                        content: 'Fresh database from major e-commerce site for sale. 10M user records with email, password hashes, and addresses. Price: 2 BTC. DM for sample.'
                        author_name: DataSeller
                        external_author_id: 9876543210
                        date_posted: '2025-06-05T14:57:53Z'
                        url: https://t.me/c/9876543210/554
                      metadata:
                        tags:
                        - DATABASE
                        - SALE
                        date_scraped: '2025-06-05T15:27:28Z'
                      target_data:
                        external_channel_id: 9876543210
                        channel_name: Shadow Market
                        channel_identifier: shadow_market_sales
                    - id: 6841c68aeb9bce48fb5b3901
                      content:
                        title: 'CRD_TRDR | Message #5053'
                        content: "#SecureVPN \n\n\U0001D5D8\U0001D5FA\U0001D5EE\U0001D5F6\U0001D5F9:\U0001D5E3\U0001D5EE\U0001D600\U0001D600\U0001D604\U0001D5FC\U0001D5FF\U0001D5F1\n\njohn.doe@example.com\nExamplePass1!\n\nalex.smith@example.com\nPassExample2!\n\nandy.j@example.co.uk\nAnotherP4ss!\n\nm.pont@example.fr\nFr3nchP4ss"
                        author_name: CRD_TRDR
                        external_author_id: 1765503461
                        date_posted: '2025-06-05T13:52:13Z'
                        url: https://t.me/c/1765503461/5053
                      metadata:
                        tags:
                        - CREDENTIALS
                        date_scraped: '2025-06-05T16:32:11Z'
                      target_data:
                        external_channel_id: 1765503461
                        channel_name: CRD_TRDR_CHANNEL
                        channel_identifier": CRD_TRDR
                    - id: 683f1dc8f211bc0c044bbcfa
                      content:
                        title: 'PhishKits | New Product #42'
                        content: 'New Bank of America phishing kit available. High quality, undetectable. Includes login page, CC form, and admin panel. $250 in XMR. Link: http://example-phish-kit.com/boa_kit.zip'
                        extracted_links:
                        - http://example-phish-kit.com/boa_kit.zip
                        extracted_domains:
                        - example-phish-kit.com
                        author_name": PhishMaster
                        external_author_id": 1034068795
                        date_posted": '2025-06-03T12:34:47Z'
                        url: https://t.me/c/1034068795/42
                      metadata:
                        tags:
                        - PHISHING
                        - SALE
                        date_scraped: '2025-06-03T16:07:38Z'
                      target_data:
                        external_channel_id: 1034068795
                        channel_name: Phishing Kits & Tools
                        channel_identifier: phish_kits
                    total_results: 5277
        '206':
          description: Returns a list of telegram messages (Partial content if response would exceed 4MB)
          headers:
            X-RateLimit-Limit:
              schema:
                type: integer
              description: Request limit per second. Defaults 200 per second
            X-RateLimit-Remaining:
              schema:
                type: integer
              description: The number of requests left for the time window.
            X-RateLimit-Reset:
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TelegramSearchResponse'
        '400':
          description: Bad request (Indicates incorrect / missing values)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '422':
          description: Unprocessable Entity (Indicates invalid Lucene query)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - ApiKeyAuth: []
  /scraped-content/ransomware:
    post:
      tags:
      - Dark Web Intelligence
      summary: Scraped ransomware content search
      description: 'This endpoint allows users to search through scraped ransomware incident content found on the variety of groups in dark web ecosystem using a Lucene query as the main search query.

        It provides a powerful and flexible search capability by allowing users to construct complex queries to filter and retrieve specific ransomware blog content.


        **Example Lucene Query:**

        - To search for messages with the word "malware" in the content field, authored by "john doe":


        `content:malware AND author_name:"john doe"`


        Search phrases can be optionally highlighted in the search results using the `highlight_params` object.

        All keywords that are matched by the query will be wrapped with passed starting and ending tags.


        The endpoint can return a maximum of 10,000 records. An offset plus limit that exceeds 10,000 will result in a bad request


        **Rate limit: 50 per second.**'
      operationId: ransomwareSearch
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RansomwareSearchRequest'
        required: true
      responses:
        '200':
          description: Returns a list of ransomware incidents
          headers:
            X-RateLimit-Limit:
              schema:
                type: integer
              description: Request limit per second. Defaults 200 per second
            X-RateLimit-Remaining:
              schema:
                type: integer
              description: The number of requests left for the time window.
            X-RateLimit-Reset:
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RansomwareSearchResponse'
              examples:
                ransomwareIncidents:
                  summary: Example of a ransomware incident search response
                  value:
                    data:
                    - id: 6842bc300046021e79cbf22b
                      content:
                        title: Synopsys/synopsys.com targeted in ransomware attack by Arkana
                        author_name: Arkana
                        date_posted: '2025-06-06T12:04:54Z'
                      ransom_data:
                        victim_name": Synopsys
                        victim_domain": synopsys.com
                      metadata:
                        tags:
                        - RANSOMWARE_INCIDENT
                        - TOP_50000_CF
                        date_scraped: '2025-06-06T10:00:16Z'
                        screenshot_identifier: 6842bc300046021e79cbf22b
                      enrichment_data:
                        name: Synopsys Inc
                        domain: synopsys.com
                        website: https://www.synopsys.com
                        industry: Software Development
                        type: Public Company
                        size_range: 10,001+ employees
                        location:
                          country: United States
                          country_iso2: US
                          location: Sunnyvale, California 94085, US
                          full_address: 675 Almanor Ave; Sunnyvale, California 94085, US
                        socials:
                        - platform: 1
                          url: https://www.facebook.com/synopsys
                        - platform: 2
                          url: https://www.linkedin.com/company/synopsys
                        - platform": 3
                          url: https://www.twitter.com/synopsys
                        - platform: 4
                          url: https://www.crunchbase.com/organization/synopsys
                        - platform: 5
                          url: https://www.instagram.com/synopsyslife
                        - platform: 6
                          url: https://www.youtube.com/user/synopsys
                    total_results: 1
        '206':
          description: Returns a list of ransomware incidents (Partial content if response would exceed 4MB)
          headers:
            X-RateLimit-Limit:
              schema:
                type: integer
              description: Request limit per second. Defaults 200 per second
            X-RateLimit-Remaining:
              schema:
                type: integer
              description: The number of requests left for the time window.
            X-RateLimit-Reset:
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RansomwareSearchResponse'
        '400':
          description: Bad request (Indicates incorrect / missing values)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '422':
          description: Unprocessable Entity (Indicates invalid Lucene query)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - ApiKeyAuth: []
  /scraped-content/marketplace:
    post:
      tags:
      - Dark Web Intelligence
      summary: Scraped marketplace content search
      description: 'This endpoint allows users to search through scraped marketplace post content found on the variety of groups in dark web ecosystem using a Lucene query as the main search query.

        It provides a powerful and flexible search capability by allowing users to construct complex queries to filter and retrieve specific marketplace content.


        **Example Lucene Query:**

        - To search for messages with the word "malware" in the content field, authored by "john doe":


        `content:malware AND author_name:"john doe"`


        Search phrases can be optionally highlighted in the search results using the `highlight_params` object.

        All keywords that are matched by the query will be wrapped with passed starting and ending tags.


        The endpoint can return a maximum of 10,000 records. An offset plus limit that exceeds 10,000 will result in a bad request


        **Rate limit: 50 per second.**'
      operationId: marketplaceSearch
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MarketplaceSearchRequest'
        required: true
      responses:
        '200':
          description: Returns a list of marketplace posts
          headers:
            X-RateLimit-Limit:
              schema:
                type: integer
              description: Request limit per second. Defaults 200 per second
            X-RateLimit-Remaining:
              schema:
                type: integer
              description: The number of requests left for the time window.
            X-RateLimit-Reset:
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MarketplaceSearchResponse'
              examples:
                marketplacePosts:
                  summary: Example of a marketplace post search response
                  value:
                    data:
                    - id: 67ea417b4ffad2783e9acbed
                      display_price: 14.00$
                      type: 1
                      content:
                        title: Malware Logs | Stealer [Unknown] | source | 14.00$
                        content: "Stealer: Unknown\nLog Identifier: _RO_188.27.152.93\nVictim OS: Windows 10 Pro (10.0.19045) x64\nDate: 2025-03-30T02:34:01\nCountry: RO\nLinks: \n\ntplinkrepeater.net | discord.com | signin.rockstargames.com | guns.lol | tzproject.com | store.steampowered.com | www.instagram.com | www.facebook.com | accounts.spotify.com | tria.ge | accounts.google.com | ring-1.io | www.paypal.com | totaljerkface.com | www.epicgames.com | authenticate.riotgames.com | www.spotify.com | steamcommunity.com | cheater.fun | panel.sharky.ro | doxbin.com | auth0.openai.com | botlucky.com"
                        author_name: source
                        author_url: http://exodusyzzpcnxxvpqoyyv3g4yvcy2zbfj4u7jxb56mlcfguqvehyjeqd.onion/vendor/source
                        date_posted: '2025-03-30T02:34:01Z'
                        url: http://exodusyzzpcnxxvpqoyyv3g4yvcy2zbfj4u7jxb56mlcfguqvehyjeqd.onion/bot/6ff9d472-0d0f-11f0-9fd7-002590371a8e
                      metadata:
                        tags:
                        - MARKETPLACE
                        - LOGS
                        - TOP_200_CF
                        - TOP_50000_CF
                        - TOP_20000_CF
                        - TOP_500_CF
                        date_scraped: '2025-03-30T02:34:01Z'
                        screenshot_identifier: exodusmarket.io/67ea417b4ffad2783e9acbed
                      target_data:
                        site_url: http://exodusyzzpcnxxvpqoyyv3g4yvcy2zbfj4u7jxb56mlcfguqvehyjeqd.onion
                        site_domain_name: '[Exodus Market] exodusyzzpcnxxvpqoyyv3g4yvcy2zbfj4u7jxb56mlcfguqvehyjeqd.onion'
                        site_subdomain_url: http://exodusyzzpcnxxvpqoyyv3g4yvcy2zbfj4u7jxb56mlcfguqvehyjeqd.onion/bots
                    - id: 682c3405292eec1a44f7e38f
                      display_price: 19.89$
                      type: 2
                      content:
                        title: Credit Cards | [CREDIT] | [441770][05/2027] | seller55184 | 19.89$
                        content: 'Type: VISA

                          Bin: 441770

                          Bank: KASIKORNBANK PUBLIC CO., LTD.

                          Class: CREDIT

                          Level: BUSINESS

                          EXP: 05/2027

                          Database: [19.05.2025] MIX ASIA from sniffer HQ

                          Country: Thailand

                          State: BA

                          City: Bangkok

                          Zip: 10600

                          SSN: Not Provided

                          DOB: Not Provided'
                        author_name": seller55184
                        author_url: https://bidenjxwb7khlh3djrmi6zkkmggiuoh6cnxll7my7uk25ohe27pcfryd.onion/vendor/seller55184
                        date_posted: '2025-05-20T07:49:25Z'
                        url: https://bidenjxwb7khlh3djrmi6zkkmggiuoh6cnxll7my7uk25ohe27pcfryd.onion
                      metadata:
                        tags:
                        - MARKETPLACE
                        - CARD
                        date_scraped: '2025-05-20T07:49:25Z'
                        screenshot_identifier: bidencash.asia/682c3405292eec1a44f7e38e
                      target_data:
                        site_url: https://bidenjxwb7khlh3djrmi6zkkmggiuoh6cnxll7my7uk25ohe27pcfryd.onion
                        site_domain_name: '[BidenCash] bidenjxwb7khlh3djrmi6zkkmggiuoh6cnxll7my7uk25ohe27pcfryd.onion'
                        site_subdomain_url: https://bidenjxwb7khlh3djrmi6zkkmggiuoh6cnxll7my7uk25ohe27pcfryd.onion/cards
                    total_results: 2
        '206':
          description: Returns a list of marketplace posts (Partial content if response would exceed 4MB)
          headers:
            X-RateLimit-Limit:
              schema:
                type: integer
              description: Request limit per second. Defaults 200 per second
            X-RateLimit-Remaining:
              schema:
                type: integer
              description: The number of requests left for the time window.
            X-RateLimit-Reset:
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MarketplaceSearchResponse'
        '400':
          description: Bad request (Indicates incorrect / missing values)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '422':
          description: Unprocessable Entity (Indicates invalid Lucene query)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - ApiKeyAuth: []
  /scraped-content/tags:
    post:
      tags:
      - Dark Web Intelligence
      summary: Scraped content tags lookup
      description: 'This endpoint provides a lookup for all tags currently used internally for classi

# --- truncated at 32 KB (52 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/nord-security/refs/heads/main/openapi/nord-security-dark-web-intelligence-api-openapi.yml