Forums are the storefront. The deal closes on Jabber.
The underground's real trade route is XMPP, and almost no platform indexes it. Jabbernaut searches the message corpus full-text, with room, author, IoC and date filters, over a fleet that sits in the rooms rather than visiting them.
What Jabbernaut sees
The channel nobody indexes
XMPP/Jabber is where negotiations move after the forum post. A fleet of resident clients sits in the rooms and indexes the traffic full-text, in the languages it is actually spoken. Almost no platform touches this layer.
Room, author, IoC filters
Scope to a room, follow an author handle across rooms, or filter on an indicator a message carried, whether that is a domain, an IP, an email, a file hash or a CVE, and pivot to everywhere else it appears. Crypto wallets are extracted and carried on every hit, and are a filter on Telegram and Discord rather than here.
Presence is on the record too
Joins, departures, nick changes and status updates are indexed alongside the chat as their own records. They stay out of the way by default, and one switch brings them into the same query, which is how you watch a room's membership move rather than only what it said.
Read while it is still moving
The fleet is resident rather than scheduled, so a message becomes searchable while the thread is still live. Every hit carries the time we indexed it, so the age of what you are reading is on the record instead of assumed.
The ad is public. The deal is not.
Coverage thins exactly where the transaction happens, which is why this layer is the module.
WHERE THE DEAL ACTUALLY CLOSES
coverage indicativeUNDERGROUND FORUMS
the storefront · access listed, prices hinted
TELEGRAM CHANNELS
the distribution · samples, combolists, victim announcements
XMPP / JABBER
JABBERNAUT IS HEREthe negotiation · price, escrow, delivery. the deal closes here
Bars: share of industry coverage per layer (indicative). Monitoring only the top layer means seeing the ad and missing the transaction.
Reading the market while it moves
A simulation of the corpus filling: rooms, actor clusters and the indicators they drop, in the order the resident fleet indexes them.
JABBERNAUT · STREAM VIEW
SIMULATED SAMPLEDELAYED & MASKED SAMPLE · ROOM, AUTHOR AND IOC FILTERS RUN ON THIS STREAM IN THE PLATFORM
Same data, same permissions, over HTTP
Everything the console shows, the API serves. Real endpoint, sample response, masked values.
GET /api/jabbernaut/search
REQUEST
curl -H "X-API-Key: sk_••••••••" \ "https://console.generalintels.com/api/jabbernaut/search\ ?q=corp+access&source_name=••••&created_from=2026-07-01T00:00:00&size=20"
RESPONSE · 200
{
"total": 5,
"page": 1,
"size": 20,
"next_cursor": "eyJz••••",
"results": [
{
"id": "f81b••••",
"indexed_at": "2026-07-09T22:17:40Z",
"document": {
"source_type": "jabber",
"source_name": "••••@conference.••••",
"threat_actor": { "username": "••••", "role": "member" },
"post": {
"content": "…access to a bank, price in DM, escrow ok…",
"created_at": "2026-07-09T22:17:31Z"
},
"iocs": { "domains": ["••••"], "crypto_wallets": ["bc1••••"] }
}
}
]
}Room and network identifiers are redacted in this sample. next_cursor pages past the result-window offset ceiling; include_system=true folds presence events into the same query.
Full API reference ships with your workspace: every endpoint, versioned.
Jabbernaut, honestly answered
The other windows
- SherlogCredential & Cookie Intelligence
- DragnetUnderground Content Intelligence
- CvekitVulnerability Intelligence
- MalveineThreat Intel Console & Feeds
- TelepathyMessaging Intelligence · Telegram
- GuildwireMessaging Intelligence · Discord
- BaitbackImpersonation Defense
- SoursOperator Surveillance · Closed briefing
Your competitors will learn about the leak from the invoice.
Learn about it from the log batch.
NDA-friendly briefings · global coverage · no slideware