Ransomware
Ransomware databases
Leak files exposing national IDs, driver's licenses, dates of birth, phones and addresses.
// WORKFLOW
From a domain — or any identifier — to an identified person.
Dark Eye automates the OSINT workflow end to end. Start from a domain to map and identify every exposed user, or search an email, username or phone across ransomware databases, breaches and stealer logs. The goal is always the same: identify the person behind the data.
INPUTdomain · email
username · phone
username · phone
EXPLOREbreaches · ransomware · stealers
IDENTIFYresolve to a person
PIVOTlinked identifiers
AMPLIFY100+ portals
IDENTITYidentified & enriched
Two ways to investigate
Work organization-wide from a domain, or hunt a single person from one identifier.
MODE A · ORGANIZATION-WIDE
Start from a domain
Enter a company domain and Dark Eye discovers every user whose data is exposed, then identifies and enriches each one automatically.
- Discover all exposed users tied to the domain
- Process breached, ransomware-leak and stealer records
- Autoidentify each user into a single person
- Explore their social networks and crypto wallets
- Pivot to connected identities and amplify across portals
MODE B · TARGETED
Start from an identifier
Have an email, username or phone? Dark Eye searches every source for it and builds out the person behind it.
- Search ransomware databases, breaches and stealer logs
- Find every account linked to the identifier
- Resolve the owner and their real-world identity
- Check presence across 100+ external platforms
- Pivot to phones, usernames, wallets and Telegram
Start from anything
Whatever you have, Dark Eye knows where to look and what to do next.
From an email address
Dark Eye searches ransomware databases, common breaches and stealer logs for the address, processes every hit, then autoidentifies the owner and pivots to linked phones, usernames and wallets.
From a username
The handle is matched across breaches, stealer logs and 100+ portals to find every account and the connected identities behind them.
From a phone number
The number is checked against breaches, ransomware leaks and stealer data to find the owner and their connected accounts and identifiers.
From a domain
Dark Eye discovers every exposed user in the organization, then identifies and enriches each one — social profiles, crypto wallets, phones and more.
The automation pipeline
Four automated stages — you spend credits only on what you run.
01
Explore
Pull breach, ransomware-leak & stealer data for every associated user.
02
Identify
Autoidentify resolves each footprint into one coherent person.
03
Pivot
Autopivot follows linked emails, phones and usernames to new identities.
04
Amplify
Sweep 100+ external portals to confirm presence and enrich.
THE GOAL
- Turn scattered records into one identified person
- Reveal real-world identity from ransomware-grade data
- Connect a person across email, phone, social and crypto
- Do it automatically, at investigation scale
CREDIT COST PER ACTION
Explore · breached user
1 credit / user
Social network lookup
5 credits / user
Crypto lookup
5 credits / query
Identify · autoidentify
5 credits / user
Pivot · autopivot
1 credit / email or phone
Amplify · +100 portals
25 credits / user
Where Dark Eye looks
Every source, correlated into one identity graph.
Stealers
Infostealer logs
Credentials, cookies, sessions and system data captured by infostealer malware.
Breaches
Common breaches
The broad universe of data breaches — emails, passwords, usernames and profiles.
Social
Social networks
Profiles, handles and connections that put a face to the data.
Telegram
Telegram
Handles, IDs and group footprints linked to a target.
Crypto
Crypto wallets
Wallet addresses, balances and transaction history tied to identities.
// THE RESULT
A connected identity graph
Every finding becomes a node — breach, social, crypto, phone, email and alias — connected by the relationships Dark Eye discovers. Pivoting any node expands the graph, so one identifier can unlock an entire network.
Run your first identification.
Start from a domain or a single identifier — Dark Eye does the rest.