Use this endpoint to list Dark Web Communication objects, which are the smallest communication unit ingested in our dark web dataset.

Filters

Available filters for Dark Web Communication objects are detailed in the Dark Web Advanced Searches section of the Dark Web guide. These modifiers support complex queries using parentheses (,) and Boolean operators (AND, OR, NOT). See the Examples section for request syntax.

Examples

Search for 10 communication of paste type with any mention to DDoS attacks.

import requests

filter = "type:paste content:DDoS"

url = f"https://www.virustotal.com/api/v3/ddw_communications?filter={filter}"

headers = {
    "accept": "application/json",
    "x-apikey": <api-key>
}

response = requests.get(url, headers=headers)

Search for 6 communications where the channel name or description contains 'Data Leak', or the subject contains 'bins'. Results must also include at least one of the following credit card BINs (403567, 403568, or 403642) and specifically mention 'credit card' within the body.

import requests

filter = "(communication_channel.name:'Data Leak' OR communication_channel.description:'Data Leak' or subject:'bins') content:'credit card' (content:'403567' OR content:'403568' OR content:'403642')"
limit = 6

url = f"https://www.virustotal.com/api/v3/ddw_communications?filter={filter}&limit={limit}"

headers = {
    "accept": "application/json",
    "x-apikey": <api-key>
}

response = requests.get(url, headers=headers)

Retrieve the translated content, URL, and timestamp for 20 communications from the user 'bob' on Telegram.

import requests

filter = "author.name:bob service.name:telegram"
limit = 20
attributes = "content_translated,origin_url,timestamp"

url = f"https://www.virustotal.com/api/v3/ddw_communications?filter={filter}&limit={limit}&attributes={attributes}"

headers = {
    "accept": "application/json",
    "x-apikey": <api-key>
}

response = requests.get(url, headers=headers)

200200

400400