Dark web Background Search: FAQs

Why Am I Seeing Different Search Results?

Search results may differ even when using the same input. This behavior is expected due to the dynamic nature of live data queries.

Possible Reasons:

New or Removed Data: The data landscape changes constantly.
Max Results Per Bucket: If too many results are returned, a limit per bucket may apply, leading to partial results.
- Recommendation: Use filters by date and data bucket to refine results.
Server Maintenance: During internal updates, some data may be temporarily unavailable.
Timeouts: Network or internal system timeouts can reduce the number of results returned.
Different API Instances: Depending on your license, your account may use a different API backend with varying limitations.

Search Limitations

Feature	Supported
Full-text Search (e.g., “John Doe”)	❌ Not Supported
Regular Expressions (Regex)	❌ Not Supported
Boolean Operators (“AND”, “OR”, etc.)	❌ Not Supported

If you enter an unsupported format, you may receive an error. Always search using supported selectors (see below).

Why Can’t I See the Exact Source of Archived Data?

Norphluchs does not expose detailed origin metadata beyond what is shown in the report. You can identify the general source by:

Bucket name
Title of the result

Can I Filter the Results?

Yes. If your query returns many results:

Click the Statistics button (top-left of results panel).
Use filters by:
- Bucket
- Data Type
- Date

This improves relevance and performance.

Supported Selectors

Norphluchs supports a wide variety of structured inputs (selectors) for targeted searches.

Examples of Supported Selectors

Selector Type	Example
Email Address	`test@example.com`
Domain	`example.com`
URL	`https://example.com/path/`
IP Address (v4 & v6)	`13.107.246.59`, `2001:db8::1`
CIDR (IPv4 & IPv6)	`192.168.0.0/24`, `2001:db8::/32`
Phone Number	`+420123456789`
Bitcoin Address	`1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa`
Ethereum Address	`0x32Be343B94f860124dC4fEe278FDCBD38C102D88`
MAC Address	`00:1A:2B:3C:4D:5E`
IPFS Hash	`QmT5NvUtoM5nWFfrQdVrFtvGfKFmG7AHE8P34isapyhCxX`
SSN (U.S.)	`555-50-1234`
Monero Address	`46thSVXSPNhJkCgUsFD9WuCjW4K41DAHGL9khni2VEqmZZhfEZVvcukCp357rfhngZdviZMaeNdj5CLqhLyeK2qZRBCyL7Q`

Domain and URL Search Behavior

Norphluchs applies intelligent rules based on the selector type:

Domains:

example.com → searches domain, subdomains, emails, and URLs related to the domain.
Wildcards are automatically applied at one level (e.g., *.example.com).

URLs:

Full URLs are treated as unique.
Query parameters are removed during normalization.
Trailing slashes (/) affect uniqueness.

Examples:

example.com → finds domain, subdomains, and associated content.
https://sub.example.com/ → only finds that exact subdomain.
https://sub.example.com/path/ → only finds that exact URL.

Note: Wildcards in search input (e.g., *.example.com) do not expand behavior beyond what’s described above.

Phone Numbers

International format required:
+420123456789, 00420123456789, or 420123456789
Best result density: Russian and Eastern European numbers
Not all international phone numbers are fully supported

Understanding the X-Score

The X-Score is a relevance indicator based on real-time and historical signals. It helps users assess how meaningful the data is.

Score Range	Meaning
0–30	🟢 Low risk – may be outdated or low relevance
31–70	🟡 Medium risk – review recommended
71–100	🔴 High risk – likely current and significant

Note: The X-Score is an interpretive aid, not a formal risk classification.