Dark Web
Sweep

What we actually search.

• Dark web markets and forums. Tor-based marketplaces and forum networks where credential dumps, personal data, and stolen documents are traded. We search active markets, archived markets, and the threads where data is discussed and disputed — not just listed. Analyst-led search reads context; automated scrapers do not.
• Paste sites and clearnet leak boards. Pastebin and equivalents, GitHub gist abuse, and the clearnet sites where stolen data surfaces before reaching dark web circulation. We cover live and cached versions — content deleted within hours is often still retrievable through archive layers we monitor as standard.
• Breach corpora and aggregated credential databases. Every major breach database checked against the subject, with source attribution and breach date. We distinguish between first-generation breach data and aggregated combo lists — the risk profile of each is materially different, and we document both accordingly.
• Threat-actor channels. Telegram, Discord, and the closed messaging ecosystem where threat actors increasingly trade and discuss stolen material. Mentions of your organisation, brand, or named executives are documented with channel context, actor handle, and an assessment of whether the mention is incidental or indicative of active targeting.
• Financial fraud indicators and carding infrastructure. Carding markets and fraud shops checked for compromised payment card data, bank account credentials, and identity documents. Includes corporate card data, employee financial credentials, and BIN-level data associated with company-issued cards appearing in active fraud infrastructure.
• OSINT and surface web exposure. Exposure does not begin at the dark web. We run structured open-source searches across court records, company filings, data broker aggregators, and public databases — mapping what an adversary can learn before they reach a dark web source. Surface web findings are documented separately with clear accessibility assessments.
• Executive and named individual exposure. Executive credentials, personal data, and private information are actively sought and traded at premium value. We run a dedicated sweep against named individuals — personal email accounts, home address data, family associations, and evidence of targeted data collection — documented as a combined risk profile where personal and professional exposure intersects.
• Document and intellectual property leak detection. Leaked internal documents, contracts, strategic materials, source code, and PII data sets — searched by keyword and naming convention, not just explicit label. Where a document is found, we assess provenance, likely exfiltration route, and how widely it has circulated.
• Supply chain and third-party exposure. Breaches originating with a supplier, technology vendor, or managed service provider can expose your data without any failure on your part. We search named third parties for incidents that may have included your data in scope, documenting affected data categories and whether your organisation is named or implied in the leaked material.
• Impersonation and brand abuse infrastructure. Typosquat domains, fake social profiles, spoofed email infrastructure, and cloned sites built to impersonate your organisation or leadership. We document confirmed impersonation infrastructure and assess whether it is active, dormant, or already taken down.
• Structured findings report. Confirmed exposures with severity ratings, source attribution, and remediation guidance — delivered as a formatted analyst report within 3–7 business days. Each finding is classified by severity, data type, source, and current accessibility. A clean result is documented with the same rigour as a findings-heavy one: the absence of confirmed exposure is itself a finding.