Multi-network crawling
Purpose-built crawlers operate inside Tor, I2P, Lokinet, Telegram, and Matrix — the networks where leaks are announced, sold, and traded. Targets are operator-configurable.
Ransomware leak sites
Victim claims on ransomware leak sites are parsed continuously. If a vendor, a peer, or you are named, it's an alert with the post archived as evidence — not a screenshot someone forwards a week later.
Stealer market coverage
Infostealer logs and credential markets are watched for your domains. Hits are matched against your user base so two leaked credentials become two specific, actionable resets.
Fraud channel monitoring
Card-sharing and 'leaked data' channels are monitored for your BINs and your data. Card sightings flow directly into the leakage module's lifecycle tracking.
Brand mentions underground
Phishing kits sold with your brand baked in, access offers naming your infrastructure, chatter about your perimeter — surfaced and scored for relevance.
Evidence preservation
Every hit is archived at capture time — content, source, timestamp — so the evidence still exists when the post is deleted and legal asks for it.
Define what matters
Domains, brands, BIN ranges, executive names, vendor list. The crawlers watch everything; relevance scoring is tuned to what's yours.
Crawlers run continuously
Each network has its own crawler fleet with operator-controlled targets and cadence. New sources can be added from the admin panel as the underground moves.
Hits are normalized
A Telegram message, a leak-site post, and a forum listing become the same shape of record: source, content, entities extracted, relevance score, evidence snapshot.
Agents correlate
Leaked credentials are matched to your users, card sightings to your BIN registry, victim claims to your vendor list — the alert tells you the blast radius, not just the sighting.
Cases carry it home
Confirmed incidents open cases with SLA tracking, MITRE tagging, and the full evidence chain — ready for IR, legal, or regulator timelines.
Under the hood