Mission Domains

🕶 Dark Web Intel

Mission domain · code darkweb

Catalog sources

7 no-auth

Disciplines

mapped

Data points

covered

Skills

run →

automation

🔧 Workbench 📈 Native dashboard All sources → AI Skills Playbooks Copilot brief Report

Intelligence Disciplines

DARKINT (5) OSINT (1) CRYPTINT (1) PASTINT (1) ACTORINT (1) NETINT (1)

Data Points

onion (4) ip (2) crypto_address (1) crypto_tx (1) paste (1) password (1) email (1)

Sources for this domain (7)

Name	Category	Auth	Format
Ahmia Onion Search Search engine indexing Tor hidden services.	Dark Web	NONE	`html`	home↗ api↗
Dark.fail Onion Directory Verified onion service directory.	Dark Web	NONE	`html`	home↗
mempool.space / Blockchain.com On-chain transaction & address analytics.	CRYPTINT	NONE	`json`	home↗ api↗
Pastebin Dump Monitor (PSBDMP) Paste-site leak monitoring.	PASTINT	NONE	`json`	home↗ api↗
Ransomwatch Leak Sites Ransomware leak-site post tracker.	Dark Web	NONE	`json`	home↗ api↗
Tor Bulk Exit List Authoritative Tor exit-node list.	Dark Web	NONE	`text`	home↗ api↗
Tor Metrics Tor network relay/bridge measurement.	DARKINT	NONE	`json`	home↗ api↗

🔍 Lookup

📊 Pre-built Queries · Dark Web Intel

Sources in this domain No-auth feeds only High-severity indicators Recent additions Sanctioned entities Open cases

🔄 Live Datasets & APIs (5 key-free · ingestible)

Dataset / API	Format	Endpoint
mempool.space / Blockchain.com	`json`	https://mempool.space/api/	collect
Pastebin Dump Monitor (PSBDMP)	`json`	https://psbdmp.ws/api/	collect
Ransomwatch Leak Sites	`json`	https://raw.githubusercontent.com/joshhighet/ransomwatch/mai	collect
Tor Bulk Exit List	`text`	https://check.torproject.org/torbulkexitlist	collect
Tor Metrics	`json`	https://onionoo.torproject.org/summary	collect

Run Auto-Collect Datasets Hub Import

📜 Playbook — Dark Web Intel operations

Direction — frame the requirement for Dark Web Intel: what decision does this support, by when?
Collection — collect from the 7 mapped domain sources and enabled feeds; capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

🔗 Pivots

Sources →Country risk →Threat feed →Cases →Campaigns →

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Integrations →

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook