A kit built on your name
The actor behind a phishing kit, the thread that sells it and the lookalike domain, defanged so nothing opens by accident.
Watch terms
- Rheinmark
- Nordhafen Bank
From first sighting to the team that acts.
CTI, SOC, fraud, incident response and third-party risk teams work from the same captured evidence, each with the view it needs.
Threat intelligence for teams that answer for it.
One console and the same sealed evidence, read five ways. Pick a team to see the screen its day starts from.
CTI teams
Follow actors, leaks and access sales across sources, with evidence attached to every report.
- Profiles that join aliases, forums, wallets and contacts
- Saved searches, lexical, semantic or hybrid
- Every finding tied to its sealed capture
SOC teams
Get early warning when your domains, infrastructure, credentials or brand appear in underground conversations.
- Watchlists for domains, brands, keywords and indicators
- Alerts with an owner, grouped into incidents
- Delivered to your own tools by webhook
Fraud and brand protection
Catch data sales, impersonation and offers that target your customers.
- Posts classified by intent: selling, offering, sharing
- Lookalike domains and phishing kits, defanged
- Claimed record counts, prices and regions
Incident response
Reconstruct what was said, when and by whom, from sealed captures.
- The time the source shows and the time it was collected
- Edits tracked, with what the post said before
- Exports that carry the query and the filters
Third-party risk
Know when suppliers or partners appear on ransomware leak sites.
- Suppliers and partners added as watch terms
- Leak-site listings followed from countdown to removal
- Victim country, sector and claimed leak size
Follow one actor across every alias.
A saved search surfaces the post. The profile joins the author’s other names, forums and contacts, and the report leaves with its evidence.
Saved search
Start where the team left off
Saved searches keep the query, the mode and the filters, and everyone in the workspace can open them.
Activity
See when the handle posts
Posting hours and posts per day, across every forum the platform collects, always in UTC.
Counterparties
Meet the people around it
Counterparties come from replies, quotes and vouches in stored threads, each with its own aliases, forums and indicators.
Export
Hand over the whole profile
Export identity, forums, activity, posts and indicators as CSV, JSON or a PDF report, with timestamps in UTC.
Product screen with fictional data
From watchlist match to a named owner.
A watchlist matches a post. The alert arrives with its severity, gets an owner and joins an incident. Webhooks tell your own tools.
- Match
Watchlists for brands, domains, keywords, actors and indicators match deterministically, and can be replayed over everything already collected.
- Alert
Critical and high alerts wait in Needs attention, most severe first, with their source and age.
- Owner
Assign it to yourself or a colleague. Assigning, acknowledging and closing are recorded in the audit trail.
- Incident
Related alerts are grouped into one incident, with its own owner and state.
Product screen with fictional data
Catch impersonation and data sales early.
Watch your brand names, domains and the terms fraud runs on. Phishing kits, lookalike domains and customer data offers arrive with their evidence.
Your customers, in someone else’s database
A Russian-language sale of a payment service’s customer data, machine-translated and labelled as derived, with the original one click away.
Watch terms
- BIN list
- PAN
- payment processor
- платежн
Product screen with fictional data
What was said, when, and by whom.
When an incident starts, rebuild the conversation from the record: the original text, both timestamps, the author’s history and the sealed capture.
What was said
The post in its original language, with indicators defanged and the capture one click away.
When
Published is the time the source shows. Crawled is when it was collected. Both are kept.
By whom
The author’s aliases, forums, ranks and join dates, as each forum reports them.
Evidence stays sealed, traceable and exportable, so the next reader sees exactly what you saw.
Product screen with fictional data
Know when a supplier or partner appears.
Add suppliers and partners to a watchlist like any other term. Access sales, insider recruitment and leak-site listings that name them raise an alert.
Accounting firms
Remote access to two accounting firms, offered for sale with escrow through the forum.
Telecom and logistics
An actor who recruits insiders at telecom and logistics companies, now on a watchlist.
Leak sites
Ransomware victim listings, followed from countdown to removal, without downloading leaked data.
Ransomware leak site monitoring
Product screen with fictional data
See it on your own sources.
Tell us what you need. We will walk you through a live capture, from post to sealed record.
Request a briefing
Prefer email? Write to {{CONTACT_EMAIL}}.