MODULE 05 · Messaging Intelligence · XMPP

Forums are the storefront. The deal closes on Jabber.

The underground's real trade route is XMPP, and almost no platform indexes it. Jabbernaut searches the message corpus full-text, with room, author, IoC and date filters, over a fleet that sits in the rooms rather than visiting them.

01Capabilities

What Jabbernaut sees

The channel nobody indexes

XMPP/Jabber is where negotiations move after the forum post. A fleet of resident clients sits in the rooms and indexes the traffic full-text, in the languages it is actually spoken. Almost no platform touches this layer.

Room, author, IoC filters

Scope to a room, follow an author handle across rooms, or filter on an indicator a message carried, whether that is a domain, an IP, an email, a file hash or a CVE, and pivot to everywhere else it appears. Crypto wallets are extracted and carried on every hit, and are a filter on Telegram and Discord rather than here.

Presence is on the record too

Joins, departures, nick changes and status updates are indexed alongside the chat as their own records. They stay out of the way by default, and one switch brings them into the same query, which is how you watch a room's membership move rather than only what it said.

Read while it is still moving

The fleet is resident rather than scheduled, so a message becomes searchable while the thread is still live. Every hit carries the time we indexed it, so the age of what you are reading is on the record instead of assumed.

The market has layers

The ad is public. The deal is not.

Coverage thins exactly where the transaction happens, which is why this layer is the module.

WHERE THE DEAL ACTUALLY CLOSES

coverage indicative

UNDERGROUND FORUMS

the storefront · access listed, prices hinted

INDEXED BY NEARLY EVERYONE

TELEGRAM CHANNELS

the distribution · samples, combolists, victim announcements

INDEXED BY SOME

XMPP / JABBER

JABBERNAUT IS HERE

the negotiation · price, escrow, delivery. the deal closes here

INDEXED BY ALMOST NOBODY

Bars: share of industry coverage per layer (indicative). Monitoring only the top layer means seeing the ad and missing the transaction.

Near-real-time

Reading the market while it moves

A simulation of the corpus filling: rooms, actor clusters and the indicators they drop, in the order the resident fleet indexes them.

JABBERNAUT · STREAM VIEW

SIMULATED SAMPLE
22:17:31····@conference.····BZK-107…access to a bank, price in DM, escrow ok…domain ×1wallet ×1
22:18:04····@conference.····BZK-041…fresh logs, 2k lines, EU mix, sample on request…sample ×1
22:19:47····@exchange.····BZK-233…need checker for corp VPN list, paying in XMR…
22:21:12····@conference.····BZK-107…deal via garant only, forum rep attached…
22:23:55····@market.····BZK-318…selling panel access, telecom sector, proof inside…domain ×2

DELAYED & MASKED SAMPLE · ROOM, AUTHOR AND IOC FILTERS RUN ON THIS STREAM IN THE PLATFORM

02The API is the product

Same data, same permissions, over HTTP

Everything the console shows, the API serves. Real endpoint, sample response, masked values.

GET /api/jabbernaut/search

REQUEST

curl -H "X-API-Key: sk_••••••••" \
  "https://console.generalintels.com/api/jabbernaut/search\
?q=corp+access&source_name=••••&created_from=2026-07-01T00:00:00&size=20"

RESPONSE · 200

{
  "total": 5,
  "page": 1,
  "size": 20,
  "next_cursor": "eyJz••••",
  "results": [
    {
      "id": "f81b••••",
      "indexed_at": "2026-07-09T22:17:40Z",
      "document": {
        "source_type": "jabber",
        "source_name": "••••@conference.••••",
        "threat_actor": { "username": "••••", "role": "member" },
        "post": {
          "content": "…access to a bank, price in DM, escrow ok…",
          "created_at": "2026-07-09T22:17:31Z"
        },
        "iocs": { "domains": ["••••"], "crypto_wallets": ["bc1••••"] }
      }
    }
  ]
}

Room and network identifiers are redacted in this sample. next_cursor pages past the result-window offset ceiling; include_system=true folds presence events into the same query.

Full API reference ships with your workspace: every endpoint, versioned.

Questions

Jabbernaut, honestly answered

Your competitors will learn about the leak from the invoice.

Learn about it from the log batch.

NDA-friendly briefings · global coverage · no slideware