Dark Web Intelligence
See what is being sold, said and planned about you.
Criminal forums, illicit markets and closed channels are where breaches are monetized and attacks are planned. Our analysts work these spaces every day, verify what they find and connect anonymous personas to the activity and infrastructure behind them.
- Typical duration
- Point-in-time assessment in 2 weeks
- Coverage
- Forums, markets, paste sites, leak sites and closed channels
- Team
- Threat intelligence analysts with language and blockchain specialists
- Deliverable
- Verified findings, actor profiles and exposure report
- Pricing
- Fixed fee assessment, or annual monitoring
When to call us
When the threat is being traded.
Automated feeds can tell you your name appeared somewhere. Our analysts tell you whether it matters, whether it is new and who is behind it.
Leak and breach claims
A post claims to sell your data. We establish whether it is real, whether it is new and whether it is actually yours.
Access for sale
Brokers advertising remote access, credentials or footholds in your network, often weeks before an attack.
Ransomware and extortion
Leak site postings, actor history and track record, giving your incident team context for its decisions.
Fraud tooling
Phishing kits, card shops and account takeover tools that target your customers or carry your brand.
Threat actor attribution
Personas linked across forums and over time, and connected to real-world activity where the evidence allows.
Insider recruitment
Posts seeking employees or contractors of your organization who are willing to sell access or information.
What you receive
Verified, not just forwarded.
A forwarded screenshot of a forum post is not intelligence. We verify claims, assess the actor behind them and tell you what to do about it.
- Verification of claimed leaks using public samples and metadata, never by purchasing data
- Actor profiles covering aliases, history, reputation and operating patterns
- Exposure reports on credentials, documents and customer data tied to your organization
- Blockchain tracing of payments where public ledgers allow it
- Recommendations for containment, notification and legal action
- Evidence captured and hashed at collection for incident and legal teams
- 2026-09-14Persona "grey_harbor" joins forum, vouched for by two established sellers
- 2026-10-02Offers remote access to a logistics company matching client profile
- 2026-10-03Same public encryption key found on a second persona on another forum
- 2026-10-04Payout address clusters with wallet used in a 2025 extortion case
- Evidencesha256 9b1e4c07a2f85d3e61c0b7a94f2e8d15c6a3b07e9f41d28c5a6e03b7d9c14f2a
How it runs
A two-week assessment, or continuous coverage.
Most clients start with a point-in-time assessment of their exposure, then move the detectors it produces into continuous monitoring.
-
01 / Scope
Days 1 to 2
We agree the domains, brands, executives, products and key vendors in scope, and the incident or concern driving the work.
-
02 / Collect
Days 2 to 8
Forums, markets, paste and leak sites and channels are searched current and historically through vetted research personas.
-
03 / Verify
Days 5 to 10
Claims are validated, recycled data is separated from new exposure and each actor's credibility is assessed.
-
04 / Report
Days 9 to 14
Findings, actor profiles and prioritized recommendations, with an optional handover into continuous monitoring.
Tradecraft
Inside the spaces, within the rules.
Dark web research can be done carelessly or unlawfully. Ours is neither. These are the methods our analysts use, and the lines they do not cross.
- Long-standing research personasVetted personas used only to observe. They do not buy, sell or trade, and they are never used to deceive anyone into handing over information.
- Leak validationFile structures, metadata, internal identifiers and freshness checks on publicly posted samples, compared with known prior breaches.
- Actor correlationWriting style, reused encryption keys and handles, active hours and operational mistakes that link personas across forums.
- Blockchain analysisCommon-input ownership and change-address heuristics, clustering and flow tracing to cash-out points on public ledgers.
- Criminal language and slangNative-language analysts who read underground argot, abbreviations and coded offers as they are meant to be read.
- Market signalsPricing, vouching, escrow history and reputation scores used to judge whether a seller and an offer are credible.
- Safe handlingIsolated collection environments and malware-safe processing, so research never puts your systems or ours at risk.
- No payments to criminalsWe never purchase stolen data, pay criminal actors or engage in negotiations. Verification is done without funding the market.
Results
From anonymous persona to action.
Dark web findings matter when they connect to something real: a wallet, a company, a person or a decision you can make today.
Freight and logistics
The breach that was not
An extortion crew claimed 4 TB of stolen files and set a 72-hour deadline. Sample analysis showed recycled data from an old third-party breach, and the demand went unpaid.
A forum post claimed to be selling our customer database. Within a day Aldervane had shown it was an old breach at a former vendor, repackaged. That answer spared us a notification exercise and a great deal of alarm.
Questions
Dark web intelligence FAQ
Do you buy leaked data or pay criminals?
No, never. We do not purchase stolen data, pay criminal actors or take part in negotiations. We verify claims using what is publicly posted, the structure and metadata of samples, and comparison with known prior breaches.
How do you access closed forums?
Through long-standing research personas maintained on isolated infrastructure. They observe only. Where a space requires criminal activity or payment to enter, we do not enter it.
Can you identify a dark web actor?
Sometimes. Actors are careful in some places and careless in others. We correlate personas across forums and time, and where the trail reaches the open web, a registry or a public ledger, we follow it. We state our confidence and never name someone the evidence does not support.
How is this different from an automated dark web feed?
Feeds match keywords and pass the results on. Our analysts read the context, verify the claim, assess the actor and tell you what it means and what to do. Many clients use both, with our team handling everything that needs judgment.
What happens if you find our data?
You are told immediately, with the evidence and our assessment of how new and how sensitive it is. We then help your incident, legal and communications teams decide on containment, notification and any legal action.
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.