Be told when it appears, then investigate it with the sources attached.
The free site lets anyone search the dark web. Pro is for teams that need to be alerted about their own brands, domains and people, to dig into what the crawler has indexed, and to feed it into their own systems through an API.
Get alerted
Watches that run on their own and tell you when something new turns up.
- Your brand and domains
- Lookalike domains seen in certificate-transparency logs, and defacement of your own site. You prove you own a domain with a DNS record before anything is fetched from it.
- People and companies
- Reputational news about a company or an executive. Dark-web posts offering access to a named company. Stolen-credential logs that concern your domain: we report which page and how many lines, never the credentials themselves.
- Any identifier
- A wallet, handle, address, CVE or other extracted entity, the moment it shows up in a new crawl. Audio or video that our forensics checks flag as possibly edited.
- Public chatter
- Posts on Bluesky, Mastodon and monitored Telegram channels, by phrase or by identifier. Public claims of defacement that name you.
- Your exposure
- Scans of domains you own: subdomains, open ports, certificates and web technology, linked to related dark-web pages.
- Where alerts go
- To your webhook, and by email if you switch it on. Every delivery attempt is logged, and failed ones are retried.
Investigate
Tools over everything the crawler has indexed.
- Ask the copilot
- Questions answered from the crawled data, with citations to the pages behind each answer.
- Search everything
- Investigator search across crawled pages and Telegram posts, with filters, and translation of posts that are not in English.
- Follow the links between things
- The entities that appear alongside one another, a cluster of identifiers that plausibly belong to the same actor (exportable as STIX 2.1), infrastructure shared between sites, and profiles of organisations named in leaks.
- See what changed
- Earlier versions of a page with a word-level comparison, trends in newly seen entities, and tracked ransom demands.
- Look safely
- An anonymized Tor viewer renders one URL for you on demand.
- Social signals
- Groups of posts telling the same story, and groups of near-identical posts from several accounts that are worth a human look.
- Write it up
- A standard investigation-report template.
Everything comes from public sources and our own crawl. Results are leads for a person to check, not proof. Defacement and coordination results are claims and patterns, not confirmed facts.
Build on it
An API, so it fits the tools you already use.
- REST API
- Everything above is available over an authenticated API with your own keys. Read the documentation.
- Control and accountability
- An activity log of key and watch changes, and export or deletion of your account data.
- For MSSPs
- A multi-client view with an overall alert count across the organisations you manage, while each client sees only its own data.