Know before it hits the leak sites.
Continuous monitoring of ransomware leak sites, dark web marketplaces and public Telegram channels – built for European organisations that need early warning, not another dashboard.
Request monitoring See pricing
EU-hosted · no tracking cookies · manually verified onboarding · source-linked findings
What we monitor
Ransomware leak sites
Victim publications from active extortion groups, matched against your domains, brands and subsidiaries.
Marketplaces & forums
Availability and activity signals from dark web markets and forums – including access brokers and credential listings.
Telegram channels
Public vendor and leak channels, scored for criminal indicators and monitored for your keywords.
Credential exposure
Indicators that company accounts appear in stealer logs or breach dumps – with source and context.
How it works
1. Request
Tell us the domains, brands and keywords you are authorised to monitor.
2. Verification
We check authorisation and scope before anything is activated. No monitoring without approval.
3. Monitoring
Automated collection every six hours, correlation against your scope.
4. Alerts
Hits with source, timestamp and context – delivered as report or API feed.
What you get
Source-linked findings
Every hit includes the group, the leak site, the date and a link to the source – no anonymous scores.
Verified onboarding
We confirm that you are authorised to monitor the submitted domains before activation.
EU data handling
Hosted in Germany, no third-party analytics, no tracking cookies, data processing under GDPR.
Pricing
Starter
5 domains · 10 keywords · daily report · email alerts
Business
25 domains · 50 keywords · 6-hour scans · API access
Enterprise
Unlimited scope · SLA · dedicated analyst · onboarding
Prices per month, excluding VAT. Monthly cancellable. Final scope is confirmed during onboarding.
FAQ
Do you need access to our systems?
No. We only monitor publicly available sources. No agents, no credentials, no access to your infrastructure.
How fast are alerts?
Collection runs every six hours; findings appear in the next report. Enterprise customers can get shorter intervals.
Is monitoring legal?
We only process publicly accessible sources and require proof that you are authorised to monitor the submitted domains and brands.
What about false positives?
Every finding is source-linked. Leak-site claims are extortion claims, not verified incidents – we label them accordingly.
Where is data hosted?
On servers in Germany (EU). No data is sold or shared with third parties.
Can we cancel?
Yes, monthly. Access ends at the end of the billing month.
Contact
Questions about scope, pricing or onboarding:
support@tendor-it.de +49 176 42877505