Platform

One platform from dark-web signal to SOC action.

See how Offsys Intel collects, enriches, matches and delivers — and what your team sees at each step.

Book a 20-minute walkthrough

Isometric diagram of the Offsys Intel pipeline: collection, enrichment, matching, and delivery layers

How it works

From leak-site post to action, in four steps.

Sample at this stage · fictional
```
source   leak site (Tor mirror)
seen     02:09 IST
group    LOCKBYTE
post     "northwind payroll svcs
          - 212 GB - 6 days"
```

Sample at this stage · fictional

victim   Northwind Payroll Services
aka      NORTHWIND PAYROLL SVCS
sector   Business services · payroll
country  India
size     est. 200–500 staff

Sample at this stage · fictional

watchlist  vendors / payroll
entry      "Northwind Payroll
            Services Pvt Ltd"
match      name + domain
result     WATCHLIST MATCH

Sample at this stage · fictional
```
alert    Slack #sec-alerts · email
sent     02:14 IST
clocks   CERT-In 6 h · NIS2 24 h
next     Incident Flash briefing
```

Step 1

Collection: about 40 sources, around the clock.

We crawl ransomware leak sites directly over Tor, pull from vulnerability databases, threat feeds, detection-rule repos, and human-chatter channels — continuously.

Ransomware & extortion

Direct Tor crawling

ransomware.live

RansomLook

Ransomwatch

Vulnerabilities & exploits

CISA KEV

NVD

EPSS

GitHub advisories

VulnCheck

Indicators

AlienVault OTX

abuse.ch

AbuseIPDB

DataPlane

URLScan

CertStream

CIRCL/MISP feeds

TAXII feeds

Detection content

MITRE ATT&CK

Sigma rules

YARA rules

Human chatter

Mastodon

Bluesky

Paste sites

Security news RSS

Web defacements

Zone-H

Step 2

Understanding: from raw post to structured record.

Every listing goes through extraction, deduplication and enrichment before it reaches you.

Victim extractionParse names, aliases and domains from unstructured leak-site posts.

Deduplication & entity resolution“Acme Pvt Ltd” = “ACME PRIVATE LIMITED” — normalised and merged.

Industry, country, sizeClassify each victim by sector, geography and estimated headcount.

MITRE ATT&CK techniquesMap attacks to tactics and techniques for detection engineering.

Reputation dataGreyNoise, Shodan, VirusTotal, passive DNS, Pulsedive enrichments.

DGA domain detectionFlag algorithmically generated domains in IOC streams.

Step 3

Analysis: the tools your team works in.

Search, hunt, explore relationships and spot patterns across gangs, victims and indicators.

Search & huntFull-text search across victims, gangs, IOCs, CVEs and more.
Relationship graphGangs ↔ victims ↔ actors — explore connections visually.
Gang activity heatmapsSee when and where each group is most active.
Activity-spike detectionAutomatic alerts when a group's listing rate jumps.
Gang risk scoresComposite risk ranking for tracked ransomware groups.
Victim risk clusteringGroup victims by sector, geography and exposure profile.
CVE trackingTrack which vulnerabilities ransomware groups exploit.
Data-leak & defacement trackingMonitor leak dumps and web defacements alongside ransomware.

Step 4

Delivery: alerts, briefings and integrations.

Alerts on 8 conditions

New victim listed
Watchlist match
Activity spike
New gang emerges
High ransom demand
New CVE exploited
New IOC published
Feed health issue

Delivered by email, Slack and Telegram.

Briefings & exports

5 briefing formats (Weekly Outlook, Sector Edition, IOC Bulletin, Executive Brief, Incident Flash)
Exports: STIX 2.1, MISP, CSV, PDF
TAXII 2.1 server
SIEM push: Splunk HEC, Elastic, Microsoft Sentinel
REST API with API-key auth

See all integrations →

Security

Security of the platform itself.

MFA (TOTP)Every account

Role-based accessAdmin / Analyst / Read-only

API keysScoped and rotatable

Audit logEvery action recorded

Login lockoutPer-account brute-force protection

TLS everywhereEncryption in transit

See it in action.

Book a 20-minute walkthrough with our team.

Book a walkthrough