# Threat Actor Search

POST /cti/threat-actors/search: Searches threat actors.

Source: https://docs.deepinfo.com/reference/cti/threat-actor-search/

Last updated: 2026-09-27

---
`POST https://api.deepinfo.com/v1/cti/threat-actors/search`

Searches threat actors.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "name",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `name` | The threat actor's main name; other names are in `aliases`. |
| `aliases` | Other names the threat actor is known by. |
| `actor_size` | The threat actor's size, as text. |
| `actor_types` | The threat actor's types, as a list of strings. |
| `actor_sophistication` | The threat actor's level of sophistication, as text. |
| `actor_specializations` | The threat actor's specializations, as a list of strings. |
| `description` | A text description of the threat actor. |
| `law_enforcement` | Law enforcement information recorded for the threat actor, as text. |
| `contact_info.email` | E-mail addresses listed in the threat actor's contact information. |
| `contact_info.telegram_username` | Telegram usernames listed in the threat actor's contact information. |
| `contact_info.telegram_channel` | Telegram channels listed in the threat actor's contact information. |
| `contact_info.discord_username` | Discord usernames listed in the threat actor's contact information. |
| `contact_info.jabber` | Jabber (XMPP) addresses listed in the threat actor's contact information. |
| `contact_info.tox` | Tox IDs listed in the threat actor's contact information. |
| `contact_info.skype` | Skype names listed in the threat actor's contact information. |
| `contact_info.icq` | ICQ contacts listed in the threat actor's contact information. |
| `contact_info.cdn` | CDN entries listed in the threat actor's contact information. |
| `contact_info.ip_ranges` | IP address ranges listed in the threat actor's contact information. |
| `social_media.twitter` | The threat actor's Twitter (X) accounts. |
| `social_media.vimeo` | The threat actor's Vimeo accounts. |
| `websites` | Websites linked to the threat actor. |
| `payment_info.bitcoin` | Bitcoin addresses in the threat actor's payment information. |
| `payment_info.ethereum` | Ethereum addresses in the threat actor's payment information. |
| `origin_countries` | The threat actor's countries of origin; the Most Actor Hosting Countries statistic counts actors per origin country. |
| `leak_names` | Names of leaks linked to the threat actor. |
| `forum_names` | Names of the forums the threat actor is active on. |
| `market_names` | Names of the markets the threat actor is active on. |
| `forum_market_usernames` | The usernames the threat actor uses on forums and markets. |
| `targeted_regions` | The regions the threat actor has targeted. |
| `targeted_countries` | The countries the threat actor has targeted; the Most Targeted Countries statistic counts them. |
| `targeted_industries` | The industries the threat actor has targeted; the Most Targeted Industries statistic counts them. |
| `targeted_organizations` | The organizations the threat actor has targeted; the Most Targeted Organizations statistic counts them. |
| `cves_used` | CVE IDs of the vulnerabilities the threat actor has used; the Most Used CVEs statistic counts them. |
| `tools_used` | The tools the threat actor has used; the Most Used Tools statistic counts them. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `date_updated` | When the threat actor's profile was last updated (UTC date-time). |
| `date_first_seen` | When the threat actor was first seen (UTC date-time). |
| `date_last_seen` | When the threat actor was last seen active (UTC date-time). |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_active` | Whether the threat actor is considered active. |

### Sortable Fields

| Field | Description |
|---|---|
| `name` | The threat actor's main name; other names are in `aliases`. |
| `date_updated` | When the threat actor's profile was last updated (UTC date-time). |
| `date_first_seen` | When the threat actor was first seen (UTC date-time). |
| `date_last_seen` | When the threat actor was last seen active (UTC date-time). |
| `is_active` | Whether the threat actor is considered active. |
| `actor_size` | The threat actor's size, as text. |
| `actor_sophistication` | The threat actor's level of sophistication, as text. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].name` | string |  |
| `results[].aliases` | array of string |  |
| `results[].date_updated` | string | date-time |
| `results[].date_first_seen` | string | date-time |
| `results[].date_last_seen` | string | date-time |
| `results[].is_active` | boolean |  |
| `results[].actor_size` | string |  |
| `results[].actor_types` | array of string |  |
| `results[].actor_sophistication` | string |  |
| `results[].actor_specializations` | array of string |  |
| `results[].description` | string |  |
| `results[].law_enforcement` | string |  |
| `results[].contact_info` | object |  |
| `results[].social_media` | object |  |
| `results[].websites` | array of string |  |
| `results[].payment_info` | object |  |
| `results[].origin_countries` | array of string |  |
| `results[].leak_names` | array of string |  |
| `results[].forum_names` | array of string |  |
| `results[].market_names` | array of string |  |
| `results[].forum_market_usernames` | array of string |  |
| `results[].targeted_regions` | array of string |  |
| `results[].targeted_countries` | array of string |  |
| `results[].targeted_industries` | array of string |  |
| `results[].targeted_organizations` | array of string |  |
| `results[].cves_used` | array of string |  |
| `results[].tools_used` | array of string |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array |

## Examples

### 200 · OK

```bash
curl -X POST 'https://api.deepinfo.com/v1/cti/threat-actors/search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{}'
```

`Content-Type: application/json` · `deepinfo-request-id: 00000000-0000-4000-8000-0000356d0001`

```json
{
  "page": 1,
  "page_size": 25,
  "result_count": 0,
  "results": []
}
```

### 400 · Invalid Parameter (invalid page=0)

```bash
curl -X POST 'https://api.deepinfo.com/v1/cti/threat-actors/search?page=0' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{}'
```

`Content-Type: application/json` · `deepinfo-request-id: 00000000-0000-4000-8000-0000356d0001`

```json
{
  "code": 10400,
  "parameters": [
    {
      "param": "page",
      "details": [
        "Ensure this value is greater than or equal to 1."
      ]
    }
  ],
  "solution": "https://docs.deepinfo.com/reference/"
}
```

### Request Template

The request only: a request template has no response.

```bash
curl -X POST 'https://api.deepinfo.com/v1/cti/threat-actors/search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "filters": {
    "must": [
      {
        "name": "name",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "aliases",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "actor_size",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "actor_types",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "actor_sophistication",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "actor_specializations",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "description",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "law_enforcement",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "contact_info.email",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "contact_info.telegram_username",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "contact_info.telegram_channel",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "contact_info.discord_username",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "contact_info.jabber",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "contact_info.tox",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "contact_info.skype",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "contact_info.icq",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "contact_info.cdn",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "contact_info.ip_ranges",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "social_media.twitter",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "social_media.vimeo",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "websites",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "payment_info.bitcoin",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "payment_info.ethereum",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "origin_countries",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "leak_names",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "forum_names",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "market_names",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "forum_market_usernames",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "targeted_regions",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "targeted_countries",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "targeted_industries",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "targeted_organizations",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "cves_used",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "tools_used",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "date_updated",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "date_first_seen",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "date_last_seen",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "is_active",
        "type": "eq",
        "value": true
      }
    ]
  },
  "sort": [
    {
      "field": "name",
      "order": "desc"
    }
  ]
}'
```