Introduction

The Cyber API turns deep and dark web content into structured JSON - posts from Tor sites, hacking forums, marketplaces, and chat platforms, crawled continuously and enriched for threat intelligence.

Coverage

Content is collected from multiple networks, and your plan determines which of them your token can search:

telegram, openweb, tor, public_chat, discord

Results are automatically limited to the networks enabled on your account. Each post carries its network in extended.network.

Enrichment

Every post is enriched at crawl time:

• Entities - emails, phone numbers, IPs, domains, credit cards, SSNs, crypto wallet ids, and CVE identifiers extracted from the text.
• Persons, organizations, locations - named entities mentioned in the post.
• Cyber risk - an overall risk score with separate site and content components.
• Categories - content classification of the post.
• Author details - display name, user id, profile link, and known adversary group associations.

How it works

1. Send a GET request with a boolean query - see Quickstart.
2. Read the matching posts from the JSON response.
3. Follow the next URL to page through the rest - see Pagination.

A matching segmentation endpoint returns aggregate counts (top networks, domains, authors) instead of posts - see Segmentation API - and helper endpoints serve cached pages and images - see Dark Cache & Images.