hanasand

Dark web monitoring

Know when an actor page mentions your company, vendor, or domain.

Hanasand monitors ransomware and extortion metadata, matches it to watchlists, and sends notification packets for security, vendor-risk, and executive-response teams.

Best for

Company alerts

Delivery

Webhook + API

Output

Review-ready events

Webhook alert

Example payload sent when a watched term matches

Matched
{
  "eventType": "darkweb.monitoring.match",
  "deliveredAt": "2026-06-23T08:16:44.000Z",
  "severity": "review",
  "actor": "Akira",
  "company": "Acme Payments",
  "matchedTerm": "acme.com",
  "claimSummary": "Actor page lists a new victim claim and mentions financial records, contracts, and employee data.",
  "claimedAt": "2026-06-23T07:58:00.000Z",
  "sourceName": "monitored actor page",
  "sourceUrl": "https://hanasand.com/ti?query=Acme%20Payments",
  "confidence": 0.84,
  "recommendedAction": "Confirm the company match, notify vendor-risk or incident response, and watch for claim updates.",
  "pivots": [
    "Akira",
    "Acme Payments",
    "acme.com",
    "financial records"
  ]
}

Watch the names that matter

Add companies, domains, product names, suppliers, executives, and portfolio companies.

Detect fresh actor mentions

Use public trackers as seeds and owned collection for monitored actor-page metadata.

Send the alert

Deliver one compact event to a webhook, inbox, or review queue with the fields a team needs first.

API and webhook delivery

Attach monitoring to the system your team already uses.

The API is useful because it turns scattered actor-page observations into stable fields: company, actor, matched term, claim text, source, timing, confidence, and recommended action.

Create tickets when a watched supplier appears in a new victim claim.
Attach actor, company, claimed-data text, date, and source link to vendor-risk workflows.
Keep an internal actor overview current without manually copying from public trackers.
Route high-confidence company matches to Slack, Jira, SOAR, or a customer portal.

Subscribe a webhook

Add an HTTPS endpoint, choose the names to watch, and copy the payload shape for your intake system.

Fields customers pay for

The alert is small because the decision is urgent.

Developer notes
actorcompanymatchedTermclaimSummaryclaimedAtsourceNamesourceUrlconfidencerecommendedAction