Search the malware corpus and URL scans - query syntax and filters

MalwareAnalyzer by Cyble has two searchable corpora: analyzed FILES (samples with static and behavioural reports) and URL SCANS (page captures with verdicts, brands and kits). Each has its own filter grammar; tokens are combined with an implicit AND, values may be double-quoted, and a filter the backend cannot honour is refused with an explanation rather than silently ignored.

File and entity search filters

Used on the Files, Domains, IPs and URLs tabs and by GET /v1/intelligence/search. Examples: family:mirai, verdict:malicious p:5+ fs:2026-01-01+, technique:T1055, strings:"stratum+tcp".

positives: (also p:, detections:)
size:
fs: (also first_seen:, firstseen:)
ls: (also last_seen:, lastseen:)
submissions: (also times_submitted:, prevalence:)
engines: (also engine:, avlabel:, label:, signature:)
type: (also filetype:)
name: (also filename:)
family:
verdict:
tag: (also tags:)
imphash:
ssdeep:
tlsh:
strings: (also string:, str:, content:)
md5:
sha1:
sha256: (also hash:)
domain:
host: (also hostname:)
ip:
url:
path:
tld:
cidr:
ioc:
entity:
technique: (also ttp:, mitre:, attack:)
config:
c2:
mutex:
campaign: (also botnet:, build:)

URL-scan search filters

Used on the Scans tab, the brand workbench and by GET /v1/urlscan/search. Examples: impersonates:paypal, kit:kr3pto verdict:malicious, impersonates:* fs, sample:<sha256>. key:* means "has any value" - impersonates:* is every scan evidencing brand impersonation.

page.domain:
page.ip:
page.asn:
page.server:
page.apex:
domain:
ip:
url:
hash:
cert:
server:
filename:
brand:
kit:
actor:
operator:
cert.assurance:
impersonates:
cluster:
verdict:
category:
favicon:
task.tags:
tag:
sample:
malware:
family:

Note brand: matches every brand a page merely involves (a real site's own vendors included), while impersonates: is the evidenced impersonation claim - for "phishing against a brand", use impersonates:.

Brands under attack · Latest analyzed threats · API reference