Is this collection legal and ethical?

Collection is passive observation of criminal marketplaces, governed by the same ethics framework as the rest of our pipeline. The Data & Ethics page carries the full statement.

Why does Discord matter if I already monitor forums?

A forum is a public storefront with a search box. A Discord server is invite-only, has no archive a researcher can read, and is where a crew coordinates rather than advertises: tooling, targets, splits. Monitoring only forums means reading what a group wants read.

What happens to a file that was posted once?

It is stored under a content hash, so the same file posted in three servers is one record with three references, and it stays retrievable after the message that carried it is gone. That hash is a search filter, which is how you find every other place the same sample turned up.

MODULE 07 · Messaging Intelligence · Discord

The server went quiet. What was said in it?

Discord is where a good deal of the trade organises now, and it is structurally hostile to research: servers are invite-only, history is bounded by what a client will scroll, and the file someone posted is gone the moment the message is. Guildwire searches the message corpus full-text across servers, channels and threads, and keeps the attachments.

See Guildwire in a demo See pricing

01Capabilities

What Guildwire sees

Threads are first-class, not a footnote

Servers, channels and threads are each indexed as themselves and each filterable, so a conversation that split off into a thread does not fall out of the record, which is exactly where the specifics tend to move once a channel gets busy.

The attachment outlives the message

Files carried by a message are stored and typed by their actual content rather than the extension somebody typed, then deduplicated by content hash. You can filter on that hash, on the file type, or simply on "messages that carried a file", so the sample posted once is still there when you go looking.

Indicators and handles, not just words

Domains, IPs, emails, hashes, CVEs, wallets and card numbers are filters of their own, and an author handle can be followed across every server it speaks in. Full-text search runs over content, title and author together.

Every hit dated twice

A result carries both when the message was actually posted and when we indexed it, filterable and sortable independently, so you can ask what a server said last week, or what only showed up in the index last week, and get two different answers when they diverge.

Servers, channels, threads

The thread is where the specifics went

A conversation that split off is still in the record, and the file attached to it is stored once under its content hash, so the same sample posted in a second server is the same record rather than a second copy.

GUILDWIRE · FABRIC

structure illustrative

8f21•••• IS ONE STORED OBJECT REFERENCED FROM BOTH SERVERS · IDENTICAL BYTES NEVER BECOME A SECOND COPY, AND THE ROW REMEMBERS WHERE THEY WERE FIRST SEEN

02The API is the product

Same data, same permissions, over HTTP

Everything the console shows, the API serves. Real endpoint, sample response, masked values.

GET /api/guildwire/search

REQUEST

curl -H "X-API-Key: sk_••••••••" \
  "https://console.generalintels.com/api/guildwire/search\
?q=rdp+access&has_attachments=true&attachment_extension=zip&ioc_domain=••••&size=20"

RESPONSE · 200

{
  "total": 12,
  "page": 1,
  "size": 20,
  "results": [
    {
      "id": "3ad7••••",
      "indexed_at": "2026-07-16T19:04:55Z",
      "document": {
        "source_type": "discord",
        "source_name": "••••",
        "thread_url": "••••",
        "threat_actor": { "username": "••••" },
        "post": {
          "content": "…rdp + local admin, one seat left, dm…",
          "created_at": "2026-07-16T19:04:48Z"
        },
        "iocs": { "domains": ["••••"] },
        "attachments": [
          { "filename": "build.zip", "extension": "zip", "media_type": "archive",
            "hashes": { "sha256": "8f21••••" } }
        ]
      }
    }
  ]
}

Server, channel and handle identifiers are redacted in this sample. attachment_extension and attachment_media_type repeat to match several at once; created/indexed date ranges filter independently, so a query can pin either clock.

What a call costs you

Guildwire meters on the API, on a daily ceiling of its own rather than out of a pool shared with the other modules. Working the same corpus in the console is unmetered on every tier.

See the daily API ceilings

Full API reference ships with your workspace: every endpoint, versioned.

Questions

Guildwire, honestly answered

Keep exploring

The other windows

Platform overview

Your competitors will learn about the leak from the invoice.

Learn about it from the log batch.

Request a demo Explore the platform

NDA-friendly briefings · global coverage · no slideware