Maltiverse Search Engine

The Maltiverse Search Engine is the way to explore the Maltiverse database of Indicators of Compromise (IoCs): IP addresses, hostnames, URLs, samples and e-mail addresses, each enriched with its classification, the sources that reported it, threat flags, location, network and date metadata. A query written in the Maltiverse Query Language (MQL), a Lucene-style syntax, filters that database on any field, and the result set can be sorted, limited in time, grouped by field values, exported, or turned into a Threat Intelligence Feed or an Alert.

There are two Search views, with the same tools over different data, depending on the plan your organization has:

Intelligence Search: queries the global Maltiverse dataset, built from more than one hundred sources and the Maltiverse scoring engine.
Platform Search: queries only the private IoCs that your organization uploaded or ingested; it adds bulk actions on the matching IoCs.

What you can do from a Search view:

Write an MQL query with syntax highlighting and autocompletion, or let the AI Query Assistant write it from a plain-language description.
Read the results with their classification, sources, status and highlights, page through them and open any indicator.
Sort by relevance, creation time, modification time or visits and restrict the time window.
Group the results by any exact-value field and pivot from a value back into the query.
Save the query as a Threat Intelligence Feed, an Alert or a Scoring Rule.
Export the results as JSON, CSV or STIX 2.

The following sections will go over this functionalities. First, start by understanding the query language to learn how to perform meaningful searches.

Maltiverse Query Language (MQL)

MQL is the Lucene query-string syntax applied to the fields of the Maltiverse IoC index. A query is a list of clauses of the form field:value, combined with boolean operators and grouped with parentheses. The same language is used by the Search views, by the REST API /search endpoint, by Threat Intelligence Feeds and by Alerts, so a query that works in the Portal can be reused anywhere. The following sections will go over an in-depth explanation of the syntax of the search engine. You can find more fields information for search queries in the Field refence guide.

General Syntax

The following table contains the guidelines of the general syntax of the MQL:

Construct	Syntax	Example
Field clause	field:value	type:ip
Exact phrase	field:"words with spaces"	blacklist.source:"URLhaus Abuse.ch"
AND	a AND b	type:ip AND classification:malicious
OR	a OR b	country_code:ES OR country_code:PT
NOT	NOT a or -a	is_cnc:true AND NOT country_code:US
Grouping	( … )	is_cnc:true AND (country_code:ES OR country_code:PT)
Wildcards	* any characters, ? one character	url:santander as_name:AS4134*
Inclusive range	field:[a TO b]	score:[80 TO 100]
Exclusive range	field:{a TO b}	size:{0 TO 1000000}
Open range	field:[a TO *]	number_of_online_malicious_urls_allocated:[11 TO *]
Date range	field:[date TO date]	creation_time:[2026-09-01 TO 2026-09-30]
Date math	now, now-7d, now/d, now/M, now/y	modification_time:[now-7d TO now]
Field exists	_exists_:field	_exists_:nameserver
Fuzzy term	term~	blacklist.description:emotet~
Escaping	\ before a reserved character	url:\/login\?id=1

Two clauses separated only by a space are combined with OR, which is the default operator of the query engine. type:ip classification:malicious returns every IP address plus every malicious indicator; type:ip AND classification:malicious returns malicious IP addresses. When AND and OR appear in the same query, group the OR alternatives in parentheses.

Indicator types and classification

The following table describes the syntax for types and classifications of the IoC within the dataset.

Field	Values	Meaning
type	ip, hostname, url, sample, email	The kind of indicator. Leave it out to search every kind.
classification	malicious, suspicious, neutral, whitelist	The Maltiverse verdict for the indicator, derived from its reports and the scoring engine.
score	0 to 100	The numeric threat score.
blacklist.labels	malicious-activity, anomalous-activity, benign, attacker, botnet, malware, cryptominer, anonymization, phishing, compromised, reconnaissance, tor, proxy, vpn, hosting, sinkhole, cdn, iot	Normalised labels attached to each report. Use them to find a kind of activity regardless of how the source described it, for example compromised legitimate sites: blacklist.labels:compromised.
tag	free text, for example c2, phishing, dga, spam	Tags attached to the indicator.

Threat Flags

Boolean flags summarize what an indicator does. They are the most reliable way to express a threat. A flag is set by the scoring engine from every report, whereas descriptions vary from source to source. Each flag exists only on some indicator types; be careful when combining a flag with a type that does not carry it, the search engine will match nothing on those cases.

Each flag exists only on some indicator types; be careful when combining a flag with a type that does not carry it, the search engine will match nothing on those cases.

Flag	Meaning	Indicator types
is_cnc	Command and control infrastructure	ip, hostname, url
is_distributing_malware	Distributes malware	ip, hostname, url, sample
is_phishing	Phishing page or host	hostname, url
is_storing_phishing	Hosts phishing pages or kits	hostname
is_known_attacker	Reported attacker (brute force, exploitation, abuse)	ip
is_known_scanner	Reported scanner or reconnaissance source	ip
is_mining_pool	Crypto-mining pool	ip, hostname
is_iot_threat	Activity against Internet of Things targets	ip, hostname, url
is_tor_node	Tor node	ip, hostname
is_open_proxy	Open proxy	ip, hostname
is_vpn_node	VPN node	ip, hostname
is_sinkhole	Sinkhole	ip
is_hosting	Hosting provider address	ip
is_cdn	Content delivery network address	ip
is_alive	Currently online: the hostname resolves, the URL is reachable	hostname, url

Date and time

Three dates describe an indicator's life in Maltiverse: creation_time (added), modification_time (last changed, typically because a source reported it again) and last_online_time. The following table describes the date and time syntax you can use during a search:

Request	Clause
Today	creation_time:[now/d TO now]
Last 24 hours	modification_time:[now-24h TO now]
Last 7 days	modification_time:[now-7d TO now]
Last 30 days	creation_time:[now-30d TO now]
This year	creation_time:[now/y TO now]
A calendar period	creation_time:[2026-09-01 TO 2026-09-30]

Sources

blacklist.source holds the name of the feed or vendor that reported an indicator. Names are matched word by word, so use the exact name and quote it when it contains spaces; a partial name such as StopForumSpam does not match "StopForumSpam.com". Frequent sources in the Intelligence dataset include:

ThreatFox Abuse.ch	URLhaus Abuse.ch	MalwareBazaar Abuse.ch	Cyber Threat Alliance
Cyber Threat Coalition	Maltiverse	Maltiverse Threat Observatory	Maltiverse Research Team
Hybrid-Analysis	Triage	VM-Ray	Maltrail
AbuseIPDB	IPWhois.io	Cisco Umbrella	Blocklist.de (and Blocklist.de SSH, Mail, Apache)
Blocklist.net.ua	HoneyDB	Emerging Threats	CIArmy
Barracuda	StopForumSpam.com	FireHOL	OpenPhish
Phishtank	Google Safebrowsing	Antiphishing.com.ar	Abuseat.org
Sblam	Cleantalk.org	Myip.ms	Botscout
Alienvault Ip Reputation Database	GPF DNS Blocklist	TorProject.org	MalwarePatrol
SANS Internet Storm Center	Alexa	Tranco

Query examples

The following table provides a list of useful examples that you can use to start drilling data and get use to the Maltiverse Query Language.

Goal	Query
Malicious command and control servers in Spain	is_cnc:true AND country_code:ES AND classification:malicious
Command and control servers in Spain or Portugal	is_cnc:true AND (country_code:ES OR country_code:PT)
Malicious IPs related to Cobalt Strike	type:ip AND classification:malicious AND blacklist.description:"Cobalt Strike"
Malicious IPs in AS4134 that distribute malware	type:ip AND classification:malicious AND as_name:AS4134* AND is_distributing_malware:true
Hostnames distributing malware under .ru	type:hostname AND is_distributing_malware:true AND tld:ru
Phishing URLs impersonating PayPal	type:url AND is_phishing:true AND (url:paypal OR blacklist.description:PayPal)
Phishing URLs reported by OpenPhish today	type:url AND is_phishing:true AND blacklist.source:"OpenPhish" AND creation_time:[now/d TO now]
Hostnames that store phishing pages	type:hostname AND is_storing_phishing:true
Known scanners located in China	is_known_scanner:true AND country_code:CN
Known attackers reported by CIArmy	is_known_attacker:true AND blacklist.source:"CIArmy"
Tor exit nodes that are also known attackers	type:ip AND is_tor_node:true AND is_known_attacker:true
Open proxies in the United States	is_open_proxy:true AND country_code:US
Mining pools that are still alive	is_mining_pool:true AND is_alive:true
Sinkhole IP addresses	type:ip AND is_sinkhole:true
Samples of the Emotet malware	type:sample AND blacklist.description:"Emotet"
Ransomware samples added in the last 30 days	type:sample AND blacklist.description:ransomware AND creation_time:[now-30d TO now]
Indicators attributed to Lazarus Group	blacklist.description:"Lazarus Group"
Indicators tagged with ATT&CK technique T1204.002	blacklist.external_references.external_id:T1204.002
Compromised legitimate websites	type:hostname AND blacklist.labels:compromised
Newly registered domains classified as malicious	type:hostname AND classification:malicious AND domain_creation_time:[now-30d TO now]
Malicious hostnames using Cloudflare name servers	type:hostname AND classification:malicious AND nameserver:cloudflare
Malicious IPs with more than 10 blacklisted domains resolving to them	type:ip AND classification:malicious AND number_of_blacklisted_domains_resolving:[11 TO *]
Everything reported by Emerging Threats in the last 24 hours	blacklist.source:"Emerging Threats" AND modification_time:[now-24h TO now]
Whitelisted IPs in Spain	type:ip AND classification:whitelist AND country_code:ES

Run a query

To filter IoCs in the Maltiverse Portal, you need to:

1. Head to the left navigation menu and select Search.

For Platform plan users, if you select Platform Search, you will only filter the IoCs your organization has uploaded.

2. Type your query in the search field using the MQL syntax.

If you are not certain about what to write, you can use the autocomplete feature of the search engine as seen in the image above.

3. Click Search or press Enter on your keyboard to run your search. You will see the list of filtered IoCs that match your query.

Each result shows:

Type icon: IP address, hostname, URL, sample or e-mail. The icon's tooltip names the type.
Status: hostnames and URLs show Online or Offline (the is_alive flag: the hostname resolves, or the URL is reachable).
Classification: three squares under the icon. Three red squares mean malicious, two amber suspicious, one green neutral, three navy whitelist. You can hover the mouse over the icon to show the classification.
Indicator: the IP, hostname, URL, file name (or SHA-256) or e-mail address, linking to the indicator's detail page. Private IoCs link to their page under Platform.
Dates: when the indicator was created and last modified, as relative times; the exact timestamp is in the tooltip.
Blacklist entries: one line per report, description - source (for example Command & Control - Cyber Threat Alliance), each linking to the indicator.
Highlights: the fields that matched the query, with the matching text marked.
Country flag for IP addresses and hostnames; visits for samples and e-mail addresses.

4. You could also sort the data in the search by using the Sort button at the top of the search field.

The default order is creation time, newest first; the button shows the field in use (Sort ctime) and an arrow for the direction. Changing the order runs the query again from the first page. You can sort by:

Score: Relevance of each result to the query, best first. The summary then shows the best score ("Query score (N points)")
Ctime DESC / Ctime ASC: Creation time, newest or oldest first. Ctime DESC is the default.
Mtime DESC / Mtime ASC: Modification time, most recently changed or least recently changed first.
Visits DESC / Visits ASC: Visits to the indicator page, most or least visited first.

5. Additionally, you could also use the Time Filter to narrow down the results to a time window without writing a date clause. You can choose from Creation time or Modification time (the default), and a preset: last year, last month, last week, last day or last hour. Each click runs the query again.

6. You can export the data of the results of your search, by clicking on the Export button.

You can export int he following formats:

Format: json (one object per indicator, with the fields you tick in Filter fields), csv (semicolon-separated, nested data such as the blacklist entries joined with | and ,) or stix2 (a STIX 2 bundle produced by the API, saved as JSON).
Limit: signed-in users export up to 100 indicators per export; Enterprise accounts have full export capability over the result set; anonymous visitors export the 10 indicators of the current page.
The file is named after the date and time of the export, for example 2026-10-07_15:30:12_search.json.

Aggregate queries

This feature helps you drill down into data by starting from a general search and then refining it by using query fields at your disposal. You can first run a broad query to capture a wide range of IoCs, then aggregate results by fields such as country_code, domain_keyword, or state. Based on the results, you can also apply additional filters using logical operators (AND/OR) to narrow or expand your focus, turning a high-level overview into a precise, targeted investigation.

To aggregate queries, you need to:

1. Run a simple search that filters a high number of IoC, for example, type:ip. Then, click on Aggregate.

2. Select the fields you want to aggregate, you can select multiple fields at a time. Once you select the fields, simply close the Aggregate Query modal.

If a selected field does not have any associated IoCs, it will be deselected automatically.

4. Once you have aggregated the fields, you will see a tab for each of the aggregations.

5. Go into the aggregation tabs, you will see the results are organized by the numbers IoCs included on each result (number of IoCs on the right).

Seeing which values dominate a specific field queries can be extremely useful to determine which TTP IDs, software designations, or malware family codes are most dominant. This helps you identify trending threats or frequently seen indicators across your entire dataset.

6. From here you can:

Click AND add to query (1) to add an AND condition to your original query, further restricting the results to only IoCs that match both your current criteria and the chosen value.
Click OR add to query (2) to add an OR condition to your original query, broadening the results to any IoCs that match your current criteria or the chosen value.

7. Clicking any of those options opens a new window with the new search results that include both the initial query and the aggregation.

Saving a Query

You can save a query so Maltiverse keeps evaluating it. Click Save query under the editor (the button is enabled once the editor has a query).

You can save your query as:

Treat Feed: A custom Threat Intelligence Feed with the indicators that match the query, kept up to date by Maltiverse. The feed is listed under Intelligence > Feeds and can be distributed through the connectors, the TAXII server or the API.
Alert: An e-mail alert: you are notified whenever a new indicator matches the query. Feed and Alert can be selected together to get both from the same query.
Scoring Rule (Administrators only): A scoring rule that re-evaluates the matching indicators on a schedule (none, hourly, daily or a custom cron expression) and applies the configured actions, for example changing their classification.

AI Query Assistant

The AI Query Assistant writes the MQL query from a description in plain language, in any language. It knows the fields of the index, which flags apply to which indicator types, the exact source names and the date syntax, and every query it returns is validated against the index before you see it. The query is a proposal: review it, edit it in the editor if needed, then run it.

1. Click AI Query under the search field to open The AI Query Assistant modal.

2. Now simply type your request, for example: malicious ips and hostnames located in the USA. Then, click Generate Query to generate the query in the correct syntax.

3. Once the query has been generated, click on Use this query to run the search.

4. You will see the filtered search using the generated query.

Usage recommendations

Name the kind of indicator when it matters: IP addresses, hostnames (or domains), URLs, samples. Without it, the assistant searches every kind.
Name the threat with everyday words: command and control, phishing, malware distribution, scanners, brute force, Tor, proxies, VPN, mining, sinkhole, IoT. The assistant maps them to the right flags.
Add where (a country or a city), who reported it (a source name), what (a malware family, a threat actor, a tool) and when (today, the last 24 hours, this week, this month, this year).
A single criterion is a complete request: "indicators in Colombia" becomes country_code:CO. The assistant does not add a classification or a type you did not ask for.
Ask in your language. The explanation comes back in the language of the request.

The AI Query Assistant only matches data that follows the MQL, for example if a request combines a flag with a type that cannot carry it, for example online IP addresses, the assistant drops the flag and says so in the explanation.

Platform search

Platform Search (Platform plan) offers the same editor, assistant, sorting, time filter, aggregations, export and save-as tools over the private IoCs of your organization: the indicators uploaded through Upload IoC or ingested by your connectors. Results link to the private indicator pages under Platform, and feeds saved from here are built on the private dataset.

Two bulk actions can be performed in the Platform search to modify every private IoC that matches the query in the editor:

Delete by query (trash icon) shows how many IoCs match and deletes them after confirmation. There is no rollback.
Update classification by query (pencil icon) applies a new classification, malicious, suspicious, neutral or whitelist, to every matching IoC.

Run the query first before performing any of the actions and read the count in the dialog before confirming.

Field reference guide

Use any of these fields to filter and refine your queries. Here you can find the expected field formats and usage examples. Keep in mind that you can also rely on the autocomplete feature.

Common to every indicator

Field	Type	Notes
type, classification, score, tag	keyword / number	See 4.2.
creation_time, modification_time	date	When the indicator entered Maltiverse and when it last changed. The Time filter and the result timeline use them.
last_online_time	date	Last time the indicator was seen online.
visits	number	Times the indicator page was visited.
blacklist.description	text	Free text of each report: malware family, campaign, actor, technique.
blacklist.source	text	Feed or vendor that reported the indicator. Use the exact name, in quotes when it has spaces (4.6).
blacklist.labels	text	Normalised labels of the report (4.2).
blacklist.first_seen, blacklist.last_seen	date	First and last time the source saw the indicator.
blacklist.count	number	Times the source reported it.
blacklist.external_references.external_id, …source_name, …url, …description	keyword / text	External references of a report, such as MITRE ATT&CK technique IDs (external_id:T1204.002, source_name:mitre-attack).

IP addresses

Field	Type	Notes
ip_addr	ip	The address; ranges and CIDR work: ip_addr:[10.0.0.0 TO 10.0.0.255], ip_addr:"192.0.2.0/24".
ip_version	number	4 or 6.
country_code, city, state, postal_code, location	keyword / text / geo	Geolocation of the address. country_code is ISO 3166-1 alpha-2.
as_name, as_number, asn_cidr, asn_country_code, asn_registry, asn_date	text / keyword / date	Autonomous system data. as_name is text (as_name:Cloudflare); as_number is the AS number as a keyword.
cidr, address, registrant_name, registrant_organization, whois_server	text	WHOIS data of the network.
number_of_online_malicious_urls_allocated, number_of_offline_malicious_urls_allocated, number_of_domains_resolving, number_of_blacklisted_domains_resolving, number_of_whitelisted_domains_resolving	number	Counters that relate the address to the URLs and domains hosted on it; use numeric ranges.

Hostnames

Field	Type	Notes
hostname, domain, tld	text / keyword	The host, its registrable domain and its top-level domain without the dot (tld:ru).
resolved_ip.ip_addr, resolved_ip.timestamp, last_resolved_ip	ip / date	Resolution history and the last resolved address.
country_code, city, as_name, as_number	keyword / text	Inherited from the resolved address.
nameserver, dnssec, dns_request	text / keyword	DNS data; dnssec is signed or unsigned.
domain_creation_time, domain_update_time, domain_expiration_time	date	Registration dates (newly registered domains: domain_creation_time:[now-30d TO now]).
registrant_name, registrant_organization, whois_server	text	WHOIS data of the domain.
domain_lenght, domain_consonants, entropy	number	Lexical features used to spot generated domains.

URLs

Field	Type	Notes
url	text	The full URL, analysed into words (url:paypal).
urlchecksum	keyword	SHA-256 of the URL, the identifier of its detail page.
hostname, domain, tld	text / keyword	The host part of the URL.

Samples

Field	Type	Notes
sha256, sha1, md5, sha512	text	File hashes.
filename, filetype, size	text / number	File name, type and size in bytes.
antivirus.name, antivirus.description	keyword	Antivirus engine and its detection name.
av_ratio	number	Share of engines that detect the sample.
contacted_host, dns_request, http_traffic., network_suricata_alerts.	text / keyword	Network behaviour observed in the sandbox: contacted hosts, DNS requests, HTTP traffic and IDS alerts (category, description, sid).
process_list., extracted_files., mutex	text / keyword	Host behaviour observed in the sandbox: processes, dropped files and mutexes.

Emails

Field	Type	Notes
email, email_address	keyword / text	The address.

Troubleshooting

The following table presents some common cases you might encounter while drilling down the data with the search engine.

Symptom	Cause and fix
Far more results than expected	Clauses separated by spaces are combined with OR. Write AND between clauses and group OR alternatives in parentheses.
No results for a flag	The flag may not exist on the type you asked for: is_alive is tracked for hostnames and URLs, is_sinkhole for IP addresses.
No results for a source	Use the exact source name, quoted when it has spaces. Check the names with autocompletion or an aggregation on blacklist.source.keyword.
No results for a location on URLs or samples	country_code, city and as_name exist on IP addresses and hostnames only. Search the hostname of the URL instead.
A wildcard does not match	Wildcards apply to one word of an analysed text field. Use the word itself (url:wordpress) rather than a path fragment with punctuation.
A query with a literal date returns nothing	Dates are UTC; use ISO formats or date math. "This year" is creation_time:[now/y TO now].
Search is disabled	The query failed validation or the editor is empty. The message under the editor says which limit was hit.
The assistant answers with an explanation instead of a query	The request needs a field the index does not have (ports, protocols, CVEs, personal data).
"Reached limit of N requests in the last 24 hours"	The daily API quota is exhausted. The footer bar shows the consumption and the reset time; Enterprise plans have higher quotas.
A colleague does not see my results	Share the page address, it carries the query, page, sort and time filter.