Ransomware leak site monitoring
Know when your company or a supplier is named on a ransomware leak site.
When your company name or domain, or a supplier's, shows up on a leak site, you get an alert with who posted it and what they claim.
Built for defenders who need a clear alert, not another data firehose. Published pricing. No sales call to start.
You + 3 suppliers
Last 30 days
- Listed
helio-payroll.example
Supplier · Akira · 3 days ago
- Clear
northwind-labs.example
You · Clear in the last 30 days
- Clear
kestrel-hosting.example
Supplier · Clear in the last 30 days
- Mentioned
brandt-logistik.example
Supplier · Forum post · 12 days ago
How it works
Continuous monitoring, from underground source to alert
Collect
Leak sites, forums, Telegram, marketplaces and paste sites, collected continuously. Breach dumps and stealer logs are checked for a domain, continuously from Growth.
Clean & enrich
Duplicates are filtered. The hit is scored and tagged with victim, sector, country and actor. A leak-site hit also keeps its listing status.
Match
Your keywords, including a supplier's name or domain. Add either one next to your own.
Alert
Email on every plan, plus Slack, Teams, PagerDuty, ServiceNow or a signed webhook.
Suppliers
A supplier on a leak site can put you in the claim
A supplier listed on a leak site can mean your data, credentials or integrations sit in the claimed dump. Add a supplier's name or domain as a keyword next to your own.
Watch the vendors you depend on
Add a supplier's name or domain beside yours. Starter includes 10 keywords; Enterprise includes 200.
See who claimed it
Each hit links to the actor's profile: aliases, focus, targeted sectors and countries, recent victims.
Not just leak sites
Forum, Telegram and marketplace mentions of the same keywords sit next to the listing.
- Ransomware leaks
- Hacker forums
- Telegram
- Marketplaces
helio-payroll.example
- Score
- Critical
- Context
- Akira
- Status
- Scheduled
Slack
Microsoft Teams
PagerDuty
ServiceNow
Signed webhooks
Alerts and briefs
From a leak-site listing to a brief you can share
From Growth up, any alert on your keywords can become a Brief. Enterprise adds Briefs from any feed entry.
DarkWebSonar
29 Oct · 14:06
New Threat Alert
Akira listed helio-payroll.example on a leak site
Supplier keyword helio-payroll.example was posted by Akira on a ransomware leak site. The listing is still scheduled.
- Domain
- helio-payroll.example
- Actor
- Akira
- Status
- Scheduled
- Score
- Critical
View in DarkWebSonar
Same alert to email, Teams, PagerDuty, ServiceNow, or a webhook.
DarkWebSonarThreat Intelligence BriefThreat intelligence brief
Alleged leak-site listing of helio-payroll.example by Akira
Akira listed helio-payroll.example on a leak site. The listing is still scheduled.
- Entry ID
- a1b2c3d4···e5f6
- Detected
- 29 Oct 2026 · 14:06 UTC
- Threat actor
- Akira
- Classification
- TLP:AMBER
API and MCP · Pro and Enterprise
Check exposure from your own tools
Pull alerts and keywords into your SIEM, SOAR or scripts, or ask in Claude or Cursor. Available from Pro. The trial does not include API or MCP access.
Dark Web Monitoring API
Scheduled pulls into a SIEM, data lake, or script.
MCP setup
Ask about your keywords from Claude or Cursor.
Plans
Published pricing, starting at $49
Starter
$49/mo
10 keywords, a one-time domain check, email, and 1 integration.
Start trialGrowth
$99/mo
25 keywords, 1 monitored domain, email, 3 integrations, and briefs from your alerts.
Start trial- Most popular
Pro
$199/mo
50 keywords, 3 monitored domains, email, 5 integrations, API, MCP, briefs from your alerts, and a weekly summary.
Start trial Enterprise
from $499/mo
200 keywords, 10 monitored domains, email, unlimited integrations, and briefs from any feed entry.
Contact sales
Starter, Growth, and Pro open the same 14-day trial. You choose a plan after you sign up. Compare all plan details →
Common questions
Frequently asked questions
How do I know if my company is on a ransomware leak site?
Free trackers let you search once. DarkWebSonar watches your keywords continuously and emails you when they appear on a leak site or in other dark web sources.
DarkWebSonar research: KillSec leak-site takedown.
Can I monitor my suppliers too?
Yes. Add a supplier's name or domain as a keyword next to your own. Each plan has a set number of keywords.
Plan details: Compare plans.
Does a listing mean we were breached?
No. A listing is the group's claim. Treat it as a strong lead: confirm with your incident response contacts, or with the supplier, before acting.
What should I do if my company is listed?
Start from the alert: which keyword matched, who claimed it, and whether the data is still scheduled or already out. Confirm that scope with the owner of the named systems, or with the supplier, before you escalate. From Growth, the Brief packages the actor context for the people who own response and legal. Do not contact the group or open the leak site from a work device. This is operational guidance, not legal advice.
Where does the data come from?
Ransomware leak sites, underground forums, Telegram channels, marketplaces and paste sites, collected continuously and worldwide. Breach dumps and stealer logs are checked for a domain you add. Starter includes a one-time check. Continuous coverage of that domain starts on Growth.
Is this only for small companies?
No, and it is not only for large ones. A small company watches its own keywords and the suppliers it depends on. The same watch is what a larger team uses, and security and protection firms use it in their own practice.
What's included in the trial?
14 days of keyword and threat actor monitoring, your personalized threat profile, full actor profiles, and a one-time breach and infostealer check on your domain. Passwords stay masked until Growth. No card required. API and MCP access start on Pro and are not part of the trial.
How quickly will I hear about a new listing?
Alerts are sent as soon as a listing or keyword hit is collected.
See if your company or a supplier has been named.
Add your keywords, start receiving alerts. 14-day trial, no card required.