key:value tokens in the search bar. They work the same in the console and in the API’s q parameter. The query syntax page explains how tokens combine.
Values are lower-cased before matching. A value the filter cannot read (a non-numeric status, a
seen: without < or >) is ignored or searched as text; it never errors.
domain:
domain:acme.com finds every app tied to acme.com. A bare acme.com does the same. See Domain search for what “tied to” means and why comma-separated domains must all match.
provider:
provider:<slug> restricts results to one hosting platform; provider:vercel,netlify to either. Slugs are lower-case and listed on the providers page. An unknown slug matches nothing.
status:
status:<code> matches the HTTP status recorded at the last snapshot. Comma-separate to accept several.
has:creds
has:creds keeps only apps with at least one verified credential, one the scanner confirmed as live with its issuer. It is the only value has: accepts.
email:
email:<value> matches on the email addresses found on the page. A value with an @ is an exact address; a value without one is a domain, and matches any address on it.
faviconHash:
faviconHash:<hash> matches apps serving a favicon with that hash. The hash is the same one Shodan, Censys, and FOFA use, so a value from those tools works here. Clicking a favicon in the console runs this search for you. See Finding clones.
seen:
seen: filters on the last seen time, the last visit that found the app alive (see Reading an app page). seen:<7d keeps apps seen within the last 7 days; seen:>2w keeps apps not seen for more than 2 weeks. Units are h (hours), d (days), and w (weeks). You can give one lower and one upper bound; a second bound of the same kind replaces the first.