Brand & domains
Dark-web mentions
We watch forums, marketplaces, messaging channels and leak blogs to spot mentions of your organisation, your brands and your access being sold. Cybercriminal monitoring watches forums, marketplaces, messaging channels and leak blogs to spot mentions of your organisation, your brands and your access being sold.
The problem
Before an intrusion, your name circulates: an access for sale on a forum, a database offered on a marketplace, a question about your VPN in a closed channel. These signals exist days before the incident, in places your teams do not frequent. Specialised analysts maintain access there, closed spaces included, and follow the actors who sell.
Client area preview
What you see
Fictional data, for illustration only: no client, no real data.
What you get: this screen in your client area, refreshed at every synchronisation, with CSV and JSON export.
- 01
Each mention with its source, its date, the actor and an excerpt translated if needed
- 02
The analyst’s qualification: credibility, what is actually offered, what it implies for you
- 03
The history of mentions by keyword and by source, to spot a campaign taking shape
How it works
Our answer in three steps
VesperID watches forums, marketplaces, messaging channels and leak blogs for your keywords, domains and brands, and an analyst qualifies each mention: who is talking, about what, with what credibility.
- 01
You declare keywords, domains, brand names and usernames to watch, within the limit set at scoping.
- 02
Our partners’ analysts follow the forums, marketplaces and closed channels; the platform matches every post to your domains, brands and keywords, with the actor and the date.
- 03
An analyst reads each mention, discards the noise and passes on those that call for action.
Where this data comes from
Mentions come from the forums, marketplaces and messaging channels followed by our partners’ analysts, closed spaces included, and from the leak sites and pastes collected continuously; VesperID matches them to your domains, brands and keywords.
Our sources in detailCross analyses
What the platform computes on top
This service’s data is crossed with the others’: here are the analyses that come out of it, all visible in the client area.
Discover the platform- 01
Prioritisation of mentions
An access put up for sale ranks above an old mention: severity, freshness and asset criticality rank the queue.
- 02
Breach source in the chain
The source that published your data becomes a node of the exposure chain, linked to the identities and devices it touches.
What you receive
Dark-web mentions
- 01
A qualified alert for each credible mention
- 02
Log of mentions by keyword, exportable
- 03
Weekly digest when activity warrants it
- 04
Monthly analysis of the actors and sources that concern you
Frequently asked questions
Do you infiltrate forums?
We observe open and closed sources already covered by our collection; we buy nothing, negotiate nothing and do not interact with the actors.
Will we receive a lot of noise?
No: an analyst reads each mention before it is sent. A week without an alert means no credible mention was found, not that monitoring stopped.
How many keywords?
The number is capped and set at scoping, so that every mention stays actionable and the noise stays low.
Request an exposure assessment.
One hour with an analyst, not a demo: what already circulates about your organisation, what to monitor, what is better left alone. Reply within one working day.
No public price list: bespoke offering, written proposal after scoping.