{{PRODUCT_NAME}}
Request a briefing

See the underground, keep the evidence.

Needs attention on the Overview: critical and high alerts, with the incidents they belong to, each with its owner and age.

Monitor forums, closed communities, onion services and ransomware leak sites. Catch data leaks, exposed credentials and the actors behind them, each tied to a sealed capture.

Request a briefing
Overview screen: alerts that need attention, open incidents, source health and crawl activity.

Product screen with fictional data

Dark web monitoring where your tools cannot see.

Continuous dark web monitoring of forums, closed communities, deep-web sources and onion services, in many languages, Cyrillic included.

Product screens with fictional data

  • Public forums

    New threads, replies and edits picked up on a schedule.

    Rechecked on a schedule

    A thread from a public forum in the Threads screen, with its replies, last post and watchlist match.

  • Closed communities

    Session health checked and access problems flagged, on access your organization is authorized to use.

    Access problem flagged

    A thread from a closed market. The reader flags that a captcha blocks the session, so new replies wait for a person to sign in.

  • Deep-web sources

    Pages that sit behind a valid session, captured with the time they were taken.

    Session present, never shown

    The provenance of a thread: the run succeeded, the time it was crawled, and a session present with its secrets never shown.

  • Onion services

    Onion forums authorized for CTI research, read over Tor in the language they are written.

    Read over Tor, in Russian

    A thread from an onion forum, posted in Russian, in the Threads screen.

  • Ransomware leak sites

    Victim listings followed from countdown to removal.

    Each victim listing

    See leak-site monitoring
    The ransomware view of Sources: older victim listings, published, leaked or removed.

  • History

    Backfill a source’s past the day you add it. Edits are kept, so you see what a post said before.

    Edited, earlier version kept

    The revisions of a post: the contact line the author added after the first capture, kept beside the earlier version.

Data leak detection, while sales are still listed.

Posts are classified by intent, affected organization, region, data types, record counts and price, and samples are flagged.

Hover or focus a field to find it in the captured thread.Open a field to see it in the captured thread.

The full-width thread reader in {{PRODUCT_NAME}}: a post selling access to an EU regional bank, with its facts, watchlist match, post text and attachment

Product screen with fictional data

Provenance

  1. SourceThe forum where it was posted
  2. Collection runThe scheduled run that read it
  3. Sealed captureThe page as captured, fingerprinted
  4. PostThe text every value comes from
  5. FindingWhat the analyst reads, labelled
  6. WatchlistThe rule that surfaced it

Threat actor tracking across every alias.

Handles, wallets and contacts are resolved across sources, so a seller who changes names stays one actor and your watchlists follow them.

Source A, onion forum412 posts by this actor

Source B, closed market96 posts by this actor

Source C, public board31 posts by this actor

A synthetic example. The same handle on Source A and Source C, a wallet reused on Source A and Source B, and a contact shared by Source B and Source C resolve to one tracked actor.

On record for this actor

  • Actors3
  • Aliases3
  • Shared identifiers3
  • Posts6
  • Threads3
  • Indicators2
  • Organizations2
  • Countries2
  • Keys1
  • Leak listings1
  • Watchlists2
  • Alerts2
  • Incidents1

Hover or focus a node to see what it connects to.

Everything linked to this actor

  • h4rvestpostedAccess, EU regional bank
  • 198[.]51[.]100[.]23extracted fromAccess, EU regional bank
  • Access, EU regional banktargetsRegional bank, EU
  • New listingtargetsAccounting firms
  • Accounting firmslocated inNetherlands
  • Accounting firmslocated inBelgium
  • kr0nos_svcpostedEscrow rules update
  • kr0nos_svcrunsk3vq7nz2…[.]onion
  • k3vq7nz2…[.]onionmentioned inEscrow rules update
  • dust_roomreplied toAccess, EU regional bank
  • dust_roompaid toh4rvest
  • 41F7 0D9Bused byh4rvest
  • Logistics firm, DEmentionsShared contact
  • EU banks, access salesmatchedAccess, EU regional bank
  • EU banks, access salesraisedal_9f21
  • Tracked actorsmatchedharvest_ops
  • Tracked actorsraisedal_9f28
  • al_9f28grouped intoinc_204
The actor profile in the console: aliases, first and last seen, activity and a derived summary, with fictional data
The actor's forums in the console, with rank, join date and posts on each forum, with fictional data
A new listing by the same actor on another forum, in the thread reader, with fictional data
The actions menu of that listing, open on the alert it raised, with fictional data
The actor profile in the console: aliases, first and last seen, activity and a derived summary, with fictional data
The actions menu of that listing, open on the alert it raised, with fictional data

Product screen with fictional data

Who they are

Handles by source
SourceHandleRankJoinedPosts
Source Ah4rvestSellerApr 2023412
Source Bharvest_opsMemberJan 202496
Source Ch4rvestNo rankJun 202431
Identifiers
Wallet reused in 14 posts on 2 sources@proton[.]exampleContact shared on 2 sources, 9 mentionsh4rvestThe same handle on 2 sources41F7 0D9BPGP key named in 3 posts
Posting hours, UTC
Languages
English and Russian, detected per post
Seen
Apr 11, 2023 to Oct 2, 2026
Activity
539 posts, 70 in the last 30 days, 2 threads started

What they target, and who they deal with

Topics
Initial access, VPN and domain accounts, combo lists
Sectors
Banks, payment processors, accounting firms
Countries
Netherlands and Belgium, and EU banks with no country named
Prices asked
5 to 6 BTC across 3 listings, escrow only
Linked threads
[Access] EU regional bank, VPN + domain userSource A, onion forum, 41 repliesSelling RDP to accounting firms, NL/BESource D, onion forum, 4 replies
Alerts and incidents
CriticalInitial access offered for a monitored bankal_9f21HighRDP access to accounting firms in NL/BEal_9f28Incident: access sales targeting EU regional banks, 4 alertsinc_204
Deals with
dust_roomAsked about the offer, 5 interactionskr0nos_svcEscrow and vouches, 3 interactionsmirageAsked about a payments partner, 1 interaction

Synthetic data

Synthetic data

Extracted and defanged, in the product

Product screen with fictional data

IOC extraction, defanged and ready to hunt.

Emails, domains, URLs, onion addresses, IPs, hashes, CVEs and crypto wallets are pulled from every post and defanged, so nothing opens by accident.

  • Domain

    nordhafen-support[.]example

    Every dot bracketed, so it never resolves.

  • URL

    hxxps://files[.]example[.]net/s/7Qm2Lx

    Scheme disarmed to hxxps, host dots bracketed.

  • Onion address

    hxxp://k3vq7nz2…6wpx3yha[.]onion/escrow

    Shown as a defanged address, never linked.

  • CVE

    CVE-2026-21847

    Matched across every post that names it.

  • Crypto wallet

    Bitcoin
    bc1q9h7g…0pz3ve7c
    Ethereum
    0x7f3a91c4…d02be91c

    Shortened in the middle and linked across actors.

  • File hash

    MD5
    3c62e6a0960af0138dd8363e24e3f899
    SHA-1
    b20b68ec0b291b99ea5d4d9e6bb66a11dd037b31
    SHA-256
    1b8e0c7dab474a027ed90be3f00e397a07fe8b96c9c2ba52f77036e9b7d9e2f4

    Kept exactly as found: a hash cannot be opened.

  • IP address

    IPv4
    198[.]51[.]100[.]23
    IPv6
    2001[:]db8[:]4f1a[:][:]17

    Dots and colons bracketed, IPv4 and IPv6 alike.

Synthetic data

AI analysis that never overwrites the facts.

Source facts stay exactly as captured. AI enrichment lives in its own block, stamped with model, prompt version and confidence, and never overwrites them.

Evidence: the post exactly as capturedDerived: a labelled machine translation

The same replies with the translation selected: each shows its English text in a block labelled Derived, Machine translation, with model nllb-ru-en v3.1 and confidence 0.93, marked Machine translation, not evidence
The thread reader in the product with the original selected: replies in Russian, marked As captured, evidence
The same replies with the translation selected: each shows its English text in a block labelled Derived, Machine translation, with model nllb-ru-en v3.1 and confidence 0.93, marked Machine translation, not evidence
The thread reader in the product with the original selected: replies in Russian, marked As captured, evidence

Product screen with fictional data

  • Summaries of posts and whole threads.
  • Optional translation, always labelled.
  • Runs on local or self-hosted models when data must stay inside.
Derived analysis in the product: a summary and a classification of the thread, each labelled Derived and stamped with model, version and confidence
  1. Labelled Derived
  2. Model and version
  3. Confidence

Product screen with fictional data

Dark web alerts from watchlists that keep watching.

Full-text and semantic search across everything collected. Turn what you care about into watchlists, replay them over history, and route alerts to your tools.

The command menu open over the overview, to jump to any view or search threads, actors, entities and sources
Ctrl K opens the command menu instantly, from any screen.
Search results for regional bank, 49 results in 212 ms with every match highlighted, and the selected post with its defanged indicators
Search everything collected, with every match highlighted.
The alerts inbox, most severe first, with watchlist matches, owners, counts and states
Watchlist matches arrive as alerts, ready to assign and close.
The watchlists tab, with each watchlist and its terms, sources, severity and matches in the last 24 hours
Each watchlist keeps its terms, its sources and its matches.

Product screen with fictional data

  • Designed to answer in under 100 ms.

    Search and filters across everything collected.

  • Defanged by default.

    Links and addresses never open by accident.

  • Blurred until shown.

    Sensitive values stay hidden until an analyst reveals them.

Digital evidence capture you can stand behind.

Every page is captured in full, sealed with a SHA-256 fingerprint and linked to every finding it supports. Edits are kept, never overwritten.

An exploded view of one sealed capture: the captured post, its page captures, its files and its SHA-256 fingerprint.

Product screen: a captured reply, its external image not loaded and the image host defanged.

Captured post

The post as the forum served it. Its external image is never loaded, and every address is defanged.

Product screen: the thread’s page captures, each listed with its SHA-256 hash and date.

Page captures

Every page of the thread is captured in full, each with its own SHA-256 hash and date.

Product screen: the thread’s files, listed by the forum and never opened in the browser.

Files

Attachments are recorded with their name, size and hash, and never opened in the browser.

Fingerprint

A SHA-256 fingerprint over the whole capture. Change a single byte and it no longer matches.

Sealed with SHA-256

Each finding links back to this capture, its source, collection run and post, and the watchlist that surfaced it.

  1. SourceCorvid
  2. Collection runrun_6b19d4e0
  3. Sealed capturesha256 91c4ab22…
  4. Post#5
  5. Findingthr_4471
  6. WatchlistEU banks

Product screen with fictional data

An empty page is not zero new posts.

Every collection run ends in a named outcome, with source health visible for every source, so silence never hides a failure.

No new content
The source was read in full and nothing new was posted.
Authentication failed
The session was refused, and the access problem is flagged before it becomes a gap.
Challenge served
The site answered with a challenge page instead of its content.
Sources in {{PRODUCT_NAME}}: one down after its site changed, one blocked by a captcha challenge, one rate limited, each said in words
Layout drift
The page structure changed, so posts can no longer be read as before.
Parser failure
The page arrived, but its posts could not be read from it.
Network error
The source could not be reached during the run.
Partial render
Only part of the page loaded, so the run is not counted as complete.
Unusually low volume
Far fewer posts than this source usually produces in a run.
Corrupted capture
The page capture came back damaged, and the run reports it.
Evidence store unavailable
Captures could not be saved, so the run reports the gap instead of passing.
Indexing delayed
Posts were collected but are not searchable yet.

When a source is late or blocked, every thread from it says so, and the posts already stored stay readable.

When a site changes its layout, a repair is proposed and a person approves it.

The reader in {{PRODUCT_NAME}} warning that a source is rate limiting collection, so new replies can arrive late
The Sources screen in {{PRODUCT_NAME}}: fleet health by state, and each source with its health, last crawl, cadence and posts in the last 24 hours
A thread in {{PRODUCT_NAME}} from a rate-limited source: the reader says new replies can arrive late and stored posts are complete up to the last run

Product screen with fictional data

See it on your own sources.

Tell us what you need. We will walk you through a live capture, from post to sealed record.

Request a briefing

Prefer email? Write to {{CONTACT_EMAIL}}.