Which languages do you cover?

Every language the underground actually uses. Indexing and search are language-agnostic, so a listing is a first-class record whatever it is written in, and coverage is weighted toward the communities rebadged feeds underindex.

How far back does the archive go?

Coverage depth varies by source, and each result shows its capture timestamp. Deleted content remains available from the moment we first indexed it.

Can I search by indicator?

Yes. Every post is indexed with the domains, IPs, emails, file hashes, CVEs and crypto wallets found in it, and any of them is an exact-match filter you combine with a free-text query and a date range. The API returns the same result set the console shows, paginated, so a matching set can be pulled into your own tooling.

Do you support takedowns?

We do not run one. Dragnet gives you the evidence chain a takedown needs, meaning timestamps, screenshots and archived copies, but nobody here files with a registrar, a host or a platform on your behalf. Where the filing has to be done by someone, that runs through a partner rather than through us.

MODULE 02 · Underground Content Intelligence

When your name comes up in the underground, who keeps the minutes?

Dragnet runs full-text search across underground forums and ransomware blogs, with screenshots and attachments preserved. Deleted posts live on in our archive.

See Dragnet in a demo See pricing

01Capabilities

What Dragnet sees

The archive outlives the post

Actors delete listings after a sale and moderators purge threads. Our archive keeps the original content, the screenshot and every attached file, each one downloaded and fingerprinted with MD5, SHA-1 and SHA-256, so the record and the evidence both survive the delete.

Full-text, every language

Forums and ransomware blogs searched in the languages they are actually written in: the sources rebadged feeds never hear, in their own words.

IoC-aware search

Every post is parsed for indicators on the way in: domains, IPs, emails, file hashes, CVEs and crypto wallets. Each one becomes an exact-match filter, so you go from "who is talking about us" to "where else was this wallet seen" in a single query, and pivot on any URL the post linked.

Ransomware blog tracking

Victim announcements, countdowns and proof packs from ransomware leak sites, captured and timestamped as they appear.

Drawn, not described

The archive outlives the post

A listing's life, on two tracks: upstream it gets deleted; here the evidence chain keeps running.

LIFECYCLE OF A LISTING

times illustrative

One listing in, intelligence out

The post is noise. The record is the product.

Dragnet collects the listing; the labels are Centragon's, the enrichment layer every collected record passes through before any module can return it. A synthetic post here, beside the structured record that pass writes from it: category, sector, ATT&CK, detected entities with their values masked. The numbered chips say which phrase produced which field; no analyst typed any of it.

How the enrichment layer labels a record

UNDERGROUND LISTING

synthetic · values masked

title: [ПРОДАЖА] corp VPN + RDP access
target: EU fintech · rev ~$40M1

offer: creds pack · 3× email:pass
extras: OTP seed included2

panel:
sample: 3

terms: оплата USDT · escrow ok · цена 2.5k4

SOURCE & AUTHOR FIELDS EXIST ON THE REAL RECORD · NEVER SHOWN HERE

INTEL RECORD

10 of 21 fields

CATEGORYaccess_sale1

SEVERITYhigh · relevance 9/101

TARGET SECTORfinance1

MOTIVATIONfinancial4

SOPHISTICATIONmediumWHOLE POST

DATA TYPEScredentials · corporate2

ATT&CKT1078 · T1133 → TA0001 initial access1

ENTITIESEMAIL ×3 · IP ×1 · URL ×1 · values masked23

LANGUAGEru → en · machine-translated4

CONFIDENCE8/10 · rule pass + model pass, both recordedWHOLE POST

1–4 WHICH PHRASE PRODUCED WHICH FIELD · SAMPLE IS SYNTHETIC · DETECTED VALUES NEVER LEAVE THE PLATFORM

02The API is the product

Same data, same permissions, over HTTP

Everything the console shows, the API serves. Real endpoint, sample response, masked values.

GET /api/dragnet/search

REQUEST

curl -H "X-API-Key: sk_••••••••" \
  "https://console.generalintels.com/api/dragnet/search\
?ioc_domain=acme.com&source_type=forum&page=1&size=20"

RESPONSE · 200

{
  "total": 12,
  "page": 1,
  "size": 20,
  "results": [
    {
      "id": "a1b2c3d4",
      "indexed_at": "2026-07-08T19:52:11Z",
      "document": {
        "source_type": "forum",
        "source_name": "••••••",
        "thread_url": "https://••••/threads/8842",
        "post": {
          "title": "corp access, manufacturing",
          "language": "en",
          "original_post": true,
          "created_at": "2026-07-08T19:44:02Z"
        },
        "threat_actor": { "username": "••••", "reputation": 318, "role": "vendor" },
        "iocs": {
          "domains": ["acme.com"],
          "cves": ["CVE-2024-3400"],
          "crypto_wallets": ["bc1••••"]
        },
        "attachments": [
          {
            "filename": "sample.zip",
            "media_type": "archive",
            "size_bytes": 10485,
            "hashes": { "sha256": "9f2b••••" }
          }
        ]
      }
    }
  ]
}

Source and actor identifiers are redacted in this sample; the platform returns them in full.

Full API reference ships with your workspace: every endpoint, versioned.

03In practice

From listing to evidence brief

19:44

An access broker lists "corp access, AD admin" naming your domain on an underground forum.

19:52

Dragnet indexes the post with screenshot and attachments. It is now searchable, and your name is what will find it.

21:10

The author takes the listing down. We do not see that happen and we log no deletion time, but our copy of the page, as captured, stays in your case file.

09:05

Your CISO opens the morning brief with the full evidence chain: post, screenshot, actor cluster history.

Questions

Dragnet, honestly answered

Keep exploring

The other windows

Platform overview

Your competitors will learn about the leak from the invoice.

Learn about it from the log batch.

Request a demo Explore the platform

NDA-friendly briefings · global coverage · no slideware