Changelog

All notable changes to DarkWebSonar are documented here.

[1.9.5] - 2026-08-30

New Features

Threat Intelligence Briefs: Generate a downloadable PDF brief from Intel Feed events, in addition to monitoring alerts and lookalike findings.
Blog: Added threat actor coverage for The Gentlemen.

Improvements

Victim details: Events and alerts that involve more than one organization now list each victim, with country and industry for each.
Threat Actors: Actor profiles on events and alerts stay aligned with the incident you are viewing — first-seen dates, activity, and counts include the current event.
Two-Factor Authentication: Sign-in verification codes now use a dedicated six-digit input that is easier to enter and paste.
Blog: A back-to-top button with a reading-progress ring makes long posts easier to navigate.
Landing page: Added a featured-in strip highlighting coverage from industry outlets.
Trial emails: Trial onboarding emails stop once you have an active subscription.
Subscriptions: More reliable handling when a trial ends or a payment fails, including accurate remaining grace-period days.
Account retention: Inactive accounts without a subscription are removed after a warning email; unconfirmed signups are cleaned up automatically. Privacy Policy and Terms of Use now describe the timelines.

Fixes

Country & industry filters: Alerts and events with multiple victims now match country and industry filters correctly.

[1.9.4] - 2026-08-16

New Features

Password Policy: Define password rules for each monitored domain, then filter exposed credentials by whether they meet or violate your policy.
Monitoring & Alerts: Expanded the monitoring and alerting sources for monitored domains.

Improvements

Alert emails: Emails now show both when the event occurred and when we detected it.
Alert timing: Monitoring alerts are based on when we discovered an entry, so newly ingested posts still trigger timely alerts even if they were originally published earlier.
Trial plan: Trial allowances now match Starter — more monitors, threat actors, and profile updates during the trial.
Dashboard & Monitoring: Exposure summary is visible on the dashboard; easier navigation between monitoring sections; create keyword and threat-actor monitors from a single guided flow.
Filters & pagination: Cleaner filter controls on Dashboard and Events, with a choice of how many results to show per page.
Lookalike domains: More accurate risk scoring, including mail-related infrastructure signals and less noise from outdated snapshots.
Threat Actors: More consistent matching across aliases and name variants, so actor filters and profiles stay aligned.
Intel coverage: Expanded collection across additional ransomware, leak, and defacement sources, with more reliable gathering through access challenges.
API reliability: More resilient handling when upstream data services are temporarily unavailable.
Loading states: Clearer skeleton loaders while pages finish loading.

Fixes

Breach credentials: More reliable password handling when reviewing and exporting exposed credentials.
Domain monitoring: Password-policy filters no longer carry over incorrectly when switching tabs.
Geo map: Fixed map position jumping during zoom and drag.

[1.9.3] - 2026-08-01

New Features

Threat Intelligence Briefs: Generate a downloadable PDF brief from monitoring alerts and lookalike domain findings — ready to share with your team or stakeholders.
Plan Change Confirmation: When upgrading or downgrading, a clear confirmation dialog shows what you gain or lose before you complete the change.
System Notices: Important service updates can now appear as banners in the dashboard so you stay informed without leaving the app.
Blog: Added threat actor coverage for Miyako, with social sharing and a clearer related-posts experience.

Improvements

Blog: Refreshed listing layout, tag filtering, and image viewing; updated share imagery for DimasHxR and Nova posts.
Threat Actors: Long lists of countries, industries, and similar fields are easier to scan — hover to reveal the full set when values overflow.
Dashboard: KPI cards stay visually aligned when metric labels or values wrap.

Fixes

Plan entitlements: Fixed an issue where custom plan overrides were not applied correctly for some accounts.

[1.9.2] - 2026-07-13

New Features

Dashboard Saved Views: Save your dashboard filter combinations as named views and switch between them instantly — the same saved views also show up on the Intel Feed.
Region Filter: Filter dashboard alerts by region, alongside the existing country filter.
Personalized Exposure on Monitoring: The "Your Exposure" summary has moved from the Dashboard to Monitoring & Alerts, with compact clickable usage cards, clearer empty states for new accounts, and a tooltip explaining that breach counts cover all domains you've added, not just those currently monitored.

Improvements

Geo Map: Smarter map framing when filtering by region or viewing multiple countries at once, so the map automatically zooms to fit what you're looking at.
Alerts Feed: Alerts are now sorted by severity, with a clearer, unified severity color scale across the app.
Dashboard: More compact timestamps and a refreshed notifications panel for quicker scanning.

Fixes

Bot verification: Fixed the CAPTCHA widget on sign-in, registration, and password reset pages not always matching the selected theme and size.

[1.9.1] - 2026-07-10

New Features

Two-Factor Authentication: Protect your account with authenticator-app 2FA — enable it from Profile, then verify a code at sign-in.
Subscription Grace Period: Clearer visibility when a payment issue puts your subscription in a grace period, with info banners so you know what still works and what needs attention.
Security Policy: Added a public Security Policy outlining how we protect your data and our security practices.

Improvements

Integrations: More reliable Slack and custom webhook delivery and management.
Account emails: Clearer password-change notification emails.
Domain enrichment: More accurate enrichment for unknown domains in monitoring and intel workflows.

Fixes

Breaches: Fixed an issue that could prevent free and trial plan users from viewing breach details correctly.

Security

Password reset: Added bot protection on password reset to reduce abuse.
Trial fair usage: Stronger account and registration checks to ensure fair trial usage.
Breach data: Hardened encryption handling for breach data.

[1.9.0] - 2026-07-04

New Features

Custom Webhooks: Send DarkWebSonar alerts to any endpoint — configure custom webhook URLs with your own payloads and manage them from the Integrations page.
Domain Monitoring Checks: Additional detection checks for lookalike and typosquatting activity on your monitored domains.
AI-Powered Feed Quality: Low-signal entries are now automatically filtered from your intel feed using an AI quality layer, improving the signal-to-noise ratio.
Blog: Added threat actor coverage for Nova ransomware group, including TTPs, victim profile, and dark web activity.

Improvements

Domain Monitoring: Clearer alert messages and guidance when domain monitoring events are triggered.
Intel Feed: Faster filter loading on the Events page.
Plan Limits: Improved messaging when feature limits are reached, with clearer context on quotas.
Breach Alerts: Faster alert delivery for domains added to monitoring.
Intel Coverage: Improved enrichment for breach and victim entries, with quality controls and content cleaning applied at collection time; richer victim company data across recent entries.
Performance: Improved API cache warming and response times across monitoring and feed endpoints.
Dark Mode: Dark mode is now the default experience on public-facing pages.
Public Pages: Refreshed layout and spacing for public-facing pages.
Data Collection: Improved reliability across collection pipelines with better timeout handling and error recovery.

Fixes

Threat Actors: Fixed issue where personalized threat actor recommendation limits were not applied correctly.
Integrations: Fixed issue with ServiceNow integration updates not saving correctly.
Navigation: Fixed nav bar layout issue on public pages.
Blog: Fixed thumbnail display on blog post listings.

Security

Backend Hardening: Security improvements and hardening across backend services.
Webhooks: Tightened security controls for webhook configuration and management.

[1.8.8] - 2026-06-14

New Features

Events: Multiple saved filters — save named filter presets on the intel feed, switch between them, rename or delete them, and auto-load your last active filter when you return. Plan limits apply (3 on Starter, 10 on Growth, 30 on Pro, unlimited on Enterprise).
Threat actors: Personalized Threat Profile — define your sector, geography, and threat concerns to receive ranked actor recommendations and prioritized watchlist suggestions.
Breaches: Stealer log detection on domain and email breach monitoring — identify credentials exposed via malware infections, with dedicated filters and badges separate from direct breaches.

Improvements

Breaches: Further redesigned domain monitoring tables and detail drawers with richer metadata and clearer stealer-log context.
Lookalike domains: Redesigned lookalike monitoring with summary stats, clearer tables, and layout aligned with the rest of the app.
Threat actors: Refined recommendation scoring and faster page loads with improved caching.
App: Subtle spotlight accents on dashboard, monitoring, threat actors, breaches, and lookalike pages for a more polished visual experience.
Monitoring: Clearer plan limits for threat profile updates, with quota visibility and rolling 30-day reset details on the Monitoring page.
Pricing: Clearer plan feature lists including Personalized Threat Profile, stealer-log scanning, and saved filter limits.

Fixes

Breaches and lookalike domains: Fixed loading state getting stuck when refreshing results.
Domain monitoring: Fixed date parsing for domain alert timestamps.

[1.8.7] - 2026-06-03

New Features

Events: Region-based filters on the intel feed — narrow events by geographic region from the filter bar or filters modal.
Events: Copy event details from the event drawer — export full event data as JSON for reporting or sharing.
Breaches: Password exposure filter on domain monitoring — filter monitored domains by whether credentials included exposed passwords.

Improvements

Breaches: Redesigned breach monitoring tables and detail drawers with risk scores, summary stats, and a layout aligned with the rest of the app.
Breaches: Richer breach metadata in search results and detail views, with improved catalog enrichment behind the scenes.
Pricing: Updated Enterprise plan description to reflect full historical coverage.
Intel coverage: Improved deduplication for data leak source entries for more accurate event results.

Fixes

Events: Fixed saved views not applying correctly when region filters were selected.

[1.8.6] - 2026-05-26

New Features

Integrations: ServiceNow alerting — create security incidents in ServiceNow when DarkWebSonar alerts fire, with step-by-step setup in the app.

Improvements

Dashboard: Faster loads across monitoring, profile, and the header, with fewer redundant API calls.
Privacy: Reopen cookie preferences from the footer, with a direct link to the cookies section on the Privacy Policy page.
Blog: Clearer post layout and spacing, plus updated Dark Web Most Wanted coverage for the CL0P ransomware group.
Blog and SEO: Refreshed MSP monitoring content, pricing page metadata, and prerendering for better discoverability.

Fixes

Threat actors: Further improvements to threat actor matching for alerts and related filters.

Security

Access controls: Tighter handling of feature flags so users only receive relevant flag details.

[1.8.5] - 2026-05-22

New Features

Events: Custom date range on the Events page — choose any start and end within your plan history from the filter bar or filters modal.
Integrations: PagerDuty alerting so your on-call workflows can receive DarkWebSonar notifications.
Blog: RSS feed for blog posts, linked from the site footer.

Improvements

Integrations: Clearer setup flow and refreshed keyword-match alert email templates.
Footer: Updated social links for easier follow-up outside the app.
Intel coverage: Expanded ransomware and data leak sources, with stronger handling for new site formats and more reliable parsing for demanding listings.
Data quality: Improved enrichment and collection pipelines behind the scenes.

Fixes

Threat actors: More reliable threat actor matching for alerts and related filters.
Events: Fixed navigation when opening a full threat actor profile from an event.

[1.8.4] - 2026-05-08

New Features

Events: Save and reuse filters directly from the filters modal.

Improvements

Integrations: Added a clearer Microsoft Teams setup guide with step-by-step instructions.
Threat actors: Improved filtering reliability and updated threat actor aliases for clearer grouping.
Intel coverage: Expanded ransomware and data leak sources, with stronger data collection reliability behind the scenes.
Data quality: Improved enrichment and collection pipelines, plus fixes for naming discrepancies.
Blog and SEO: New blog content and refreshed sitemap generation for better discoverability.

Fixes

Threat actors: Fixed an issue where filter selections could behave inconsistently on the threat actors page.
Billing: Payment history now loads reliably, with more dependable billing portal and webhook handling.

[1.8.3] - 2026-04-27

New Features

Events: Manual refresh control so you can fetch the latest events when you are ready.

Improvements

Events: When you move between pages, the view scrolls to the top so you see results in a consistent starting position.
Trial: More of the product is available during trial, with clearer expectations for trial tiers.
Reliability: Faster repeat visits thanks to improved caching, plus steadier alert delivery when new items land in your workspace.
Public routes: Better prerendering and related SEO updates for faster, more discoverable public pages.
Content quality: Clearer auto-generated titles and summaries, more reliable screenshots, and smarter deduplication when similar content appears across related sources.
Intel coverage: Broader forum and leak-site ingestion, with stronger parsing for demanding ransomware-style listings.

Fixes

Threat actors: Subscribing from the threat actors page now completes as expected.

Security

Access controls: Stronger safeguards alongside the trial updates.

[1.8.2] - 2026-04-18

Improvements

Plans and usage: Monthly credit allowances now follow your plan more predictably, and per-alert credit charges have been removed so usage is simpler to understand.
Monitoring and events: Browser tab titles now stay aligned with the Events and Monitoring areas you have open.
Subscriptions and limits: More reliable refresh after plan changes or when returning to the app, so access limits and historical data stay accurate.
Sign-in: Smoother authentication flow and more dependable trial status when you log in.
Events: Clearer layout and styling for the events card view.
Branding: Further refinements to logo artwork.
Victim context: Clearer victim details when we enrich entries for your workspace.
Data collection: More reliable parsing for newly discovered entries, with general processing efficiency improvements behind the scenes.

Fixes

Data breaches: Corrected category labels where breach entries did not match the intended category.

Security

Account checks: Trial status is resolved with stricter access rules to improve context checking.

[1.8.1] - 2026-04-11

New Features

Entry breadcrumbs: Clearer context when viewing an entry, with breadcrumbs so you can move back without losing your place.

Improvements

CSV export: Export limit increased to 300 rows when you need a wider slice of data.
Loading: Faster, smoother loading in key views.
Filtering: Severity-based filtering now aligns with expanded API filter options so on-screen results and API queries stay consistent.
Branding: Updated product logos.
Threat actors: Clearer, more consistent naming across the product.
Screenshots: Smoother handling when screenshots are queued for display.
Data collection: Performance improvements when gathering content from forum sources.

Fixes

Event search: Searching by event ID works reliably again.
Navigation: Corrected in-app paths so links land on the right pages.
Drawers: Removed noticeable lag right after closing detail drawers.
Top navigation: Hover styling on the main navigation now clears correctly when you move the pointer away.
Titles: Fixed cases where titles did not display correctly when link targets were missing.

[1.8.0] - 2026-03-30

New Features

Lookalike Domains: New dedicated view to review domains that resemble your monitored brands, with summary stats, risk signals, filtering, and whitelisting—so you can spot potential impersonation or phishing earlier.

Improvements

Pricing: Plan details now show whether lookalike domain monitoring is included.
Domain management: Smoother workflow for managing monitored domains.
Navigation: Beta-only pages have been removed for a clearer product experience.
Placeholders: Updated placeholder imagery for consistency across the app.
Weekly summaries: General improvements to weekly threat summaries.
API: More precise date and time filtering when using the API.
Data collection: Performance improvements when gathering and processing source data.
AI-powered analysis: Faster performance from the AI models used in the product.
Connectivity and processing: More reliable connectivity and smoother AI processing behind the scenes.

Fixes

Monitoring: Fixed a case where alerts could be missing on the monitoring page when certain filters were active.
Keyword limits: Corrected behavior at the exact limit of your plan when adding keywords.
Watchlists: Threat actor and domain subscriptions now respect plan limits consistently when you add or change what you monitor.

Security

Backend requests: Tighter limits on cookie use for certain backend operations.

[1.7.1] - 2026-03-15

Improvements

Image zoom in drawers: You can now zoom images when viewing them in detail drawers for a closer look at screenshots and attachments.
Terms of use: Updated terms of use for clarity and compliance.
Data collection: Improved reliability of how we gather and process source data.
Screenshots and entries: More reliable loading and retries when viewing content.
Content pipeline: Better discovery and processing of new entries.
Threat intelligence: Refinements to how we analyze and categorize content.
Backend: Infrastructure improvements for better reliability and performance.

Fixes

Fixed issues with screenshot loading and management.

[1.7.0] - 2026-03-07

New Features

Filter by multiple countries and industries: You can now select multiple countries and multiple industries in filters to narrow results more precisely.
New FAQ: Added a new frequently asked questions section to help you find answers quickly.
Keymous blog post: New blog content covering the Keymous threat actor.

Improvements

Pricing page: General improvements to the pricing page for a clearer experience.
Maps and top cards: Removed unknown categories from maps and top N cards so the data shown is clearer and more relevant.
Proxy: Proxy improvements for more reliable connectivity.
Slogan: Updated product slogan on the landing page.

Fixes

Fixed duplicate meta tags caused by page rendering.
Fixed hero section buttons so they work correctly.

Security

Strengthened security policy for the site.

[1.6.9] - 2026-02-21

New Features

TTPs and CVEs on threat actor profiles: Threat actor profiles now include a dedicated section for MITRE techniques and CVEs so you can see tactics, techniques, and related vulnerabilities at a glance.
Date range in filter modal: Date range can be selected from within the filter modal for quicker filtering without leaving the current view.

Improvements

Threat actor profile: Faster loading of technique data and clearer layout and flow on the threat actor page.
Public routes and design: Design improvements across public-facing pages and more consistent experience.
Pagination and numbers: Counts and pagination now use thousands separators for easier reading of large numbers.
Date picker: Simplified date picker with unified date handling and fewer duplicate options.
Public content and SEO: More pages prerendered and blog content enriched for better performance and discoverability.
Loading: More reliable loading sequence in key views.

Fixes

Fixed layout issues in several views.
Confirmation dialog now displays correctly when confirming an action.
Severity filter now correctly updates result counts and pagination.
Fixed race condition when loading threat actor events.
Dashboard main image no longer blinks on load.

[1.6.8] - 2026-02-15

New Features

Threat intelligence enrichment: Threat actor profiles now include MITRE techniques and TTP (tactics, techniques, procedures) for richer threat context.

Improvements

Threat actor visuals: Consistent icons and visual style for threat actors across the app.
Typography: Clearer heading hierarchy for better readability.
Pills and badges: Consistent pill and badge formats across the app.
Severity and styles: Severity colors and styles are now consistent across all sections.
Styles and spacing: Refined transparency and spacing across the app.
Threat metrics: Clearer layout for threat metrics.
Dark mode: More consistent appearance in dark theme.
Performance: Cache warming for faster loading.
Threat actor profiles: Richer enriched profiles with additional context.
Industry categorization: Backend updates and backfilled industry data for existing entries.

Fixes

Fixed label position on map.

[1.6.7] - 2026-02-11

New Features

Threat actor focus badges: Threat actor relevance (focus percentage) is now shown with clear badges in alerts and events so you can see at a glance how much an actor is tied to a given item.
Confirm before leaving: A confirmation dialog appears before navigating to an external alert source, so you don’t leave the app by accident.

Improvements

Threat actors list – sorting: You can now sort the threat actors table by Actor, Risk, or Events. Click a column header to sort; the active column shows an up/down arrow and inactive sortable columns show an arrow icon so you can re-sort quickly.
Threat actors list – top countries: The Top Countries column now shows the country code (e.g. ARE, BRA) next to each flag for the top three countries, with incident count for clarity.
Threat actors list and cards: Improved readability and styling of the threat actors table and card views.
Threat actor profile: Richer profile with additional enrichment, a compact 2×2 activity grid (Active Since, Last Seen, activity level, Total Events), and clearer layout. Top victim countries are shown as flag, country name, then count and percentage on the same line. Attack type pills only show types with 1% or more. First Seen/Last Seen and the extra activity text were removed from the Risk Score section to avoid duplication.
Threat actor profile card: Profile cards in feeds and drawers now show the same enrichment and focus information for consistency.
Victim details: Expanded victim details section with clearer formatting in alerts and events.
Trends for new actors: Improved how trends and activity are shown for newly tracked actors.

Fixes

Fixed alerts feed formatting so items display correctly.

[1.6.6] - 2026-02-08

Improvements

User registration: Smoother registration workflow for new signups.
Industry categorization: Better organization of industry options.
Search visibility: Prerendering for key routes and general SEO improvements for better discoverability.

Fixes

Fixed modal behavior when filtering alerts.
Fixed redirects when using internal navigation.
Fixed duplicate meta tags on some pages.

Security

Security improvements for prerendered content.

[1.6.5] - 2026-02-06

New Features

Alert filtering by threat actors: Alerts can now be filtered by threat actor so you can focus on the actors that matter to you.
Threat actor–event links: Navigate from threat actor profiles directly to related events for faster investigation.

Improvements

Layout and styling: Resolved layout issues across the app for a more consistent experience.
Image handling and SEO: Optimized image sizes and rendering to improve page load and search visibility.
Pricing and plans: New pricing structure and plan names; updates to payment providers.
Grace period: Billing grace period behavior has been clarified and fixed.
Loading and performance: Reduced loading delays in key views.
Trial fair usage: Improvements to trial to ensure fair usage.
Saved views: Fixed race conditions when saving and loading dashboard views.
Sidebar and navigation: Improved sidebar naming and export button placement.
Breaches and alerts: Better breach results display and default time range for alerts.
Events and filters: Enhanced events page filters and detail drawer; general filter and drawer improvements.
UI/UX standards: Applied consistent UI/UX standards across the product.

Fixes

Fixed pricing display numbers.
Fixed scrolling issues in key pages.
Fixed filtering issues in lists and tables.
Fixed blog rendering and image loading issues.
Multiple stability and visual fixes across the platform.

[1.5.0] - Previous release

Threat actor page links to events.
Style and events page improvements.
Breaches page and breached alerts improvements.
Sidebar and export improvements.

[1.4.4] - Previous release

Noname blog post and related content.
Multiple fixes and updates.

[1.4.3] - Previous release

Terms of use updates.
Robots file and landing page updates.
Filtering and visual enhancements.

[1.3.16] - Previous release

New events drawer.
Blog rendering and analytics domain fixes.
Google Tag Manager and pagination.

[1.3.15] - Previous release

Cloudflare image transformations.
Blog and monitoring page improvements.
Cache and Turnstile visibility fixes.

[1.3.10] - Previous release

Support form and signup form.
Geo blocking and security improvements.
Animation and CSP updates.

[1.3.8] and earlier

MS Teams integration.
Keyword expression support.
Disposable email validation.
Domain monitoring and blog improvements.
Interactive dashboard filters and alerts feed layout.