Validin Query Language

Query Structure

All queries use a group prefix to specify the data source, followed by one or more criteria enclosed in parentheses:

services: (key="value")

Multiple criteria within a group can be combined with AND:

services: (http.title="Validin" AND ip="1.1.1.1")

Queries can also join multiple data sources, each with their own group:

services: (http.title="Login") AND registration: (registrar="NameCheap, Inc.") AND dns: (a="1.2.3.4")

Rules

• Group prefix required. All queries must begin with a group prefix (services:, registration:, or dns:) followed by parentheses containing your criteria.
• One group per source. You may include at most one group per data source — at most one services: group, one registration: group, and one dns: group per query.
• All criteria must be inside a group. Bare predicates outside of a group are not supported. For example, services.http.title="Validin" AND services.ip="1.1.1.1" is not valid — you must write services: (http.title="Validin" AND ip="1.1.1.1").
• At least one primary key required per group. Every group must include at least one criterion using a primary key. Secondary keys can only be used to further narrow results alongside a primary key.
• Only AND is supported. Criteria within a group, and groups with one another, are combined conjunctively.
• Exact match (=) is supported for all fields. Integer fields (port, length) additionally support !=, >, >=, <, and <=. Date fields additionally support relative modifiers — see Date Modifiers below.

Operators

Date Modifiers

Date fields support relative modifiers that express a range around a given date value:

Examples:

Find certificates expiring within 30 days of a specific date:

services: (cert.not_after="2025-05-01T17:30:25Z~30d" AND cert.issuer="/C=US/O=Let's Encrypt/CN=R3")

Find domains registered up to one day after a known date:

registration: (registered="2026-01-01T13:02:13Z+1d" AND registrar="GoDaddy, Inc.")

Find services whose certificate became valid within the last hour of a given time:

services: (cert.not_before="2025-05-01T17:30:25Z-1h" AND cert.domain="example.com")

Global Filters

Global filters are appended to the end of a query using WITH and apply across all groups:

services: (http.title="Example") WITH lookback=30 AND tld="com"

🚧

Warning

lookback and after/before are mutually exclusive: use one or the other to filter by time.

Examples

Search for hosts serving a specific page title:

services: (http.title="Example Domain")

Search for a specific IP hosting a specific title on port 8080:

services: (ip="203.0.113.50" AND http.title="Admin Panel" AND port=8080)

Search for hosts with a specific certificate issuer and JARM fingerprint:

services: (cert.issuer="/C=US/O=Let's Encrypt/CN=R3" AND jarm="29d29d15d29d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae")

Search for services running on high ports:

services: (http.title="Admin Panel" AND port>8000)

Search for certificates expiring within 30 days of a given date:

services: (cert.not_after~30d AND cert.issuer="/C=US/O=Let's Encrypt/CN=R3")

Find domains registered with a specific registrar and confirm they are actively resolving:

registration: (registrar="NameCheap, Inc.") AND dns: (a="203.0.113.50")

Find domains using a specific nameserver that are also serving a known page title, registered in the past 30 days:

services: (http.title="Login Portal") AND registration: (ns="ns1.example.com") WITH lookback=30

Cross-source investigation — services, registration, and DNS together:

services: (http.title="Phishing Page") AND registration: (registrar="GoDaddy") AND dns: (ns="ns1.example.com") WITH lookback=14

Supported Keys

services: Keys

registration: Keys

dns: Keys