EDG3 · Threat Intelligence
For every leak tied to your company's domain, EDG3 tells you whether it is new or a repost, and who is selling it. Its monitoring covers dark web forums and marketplaces, Telegram and other channels, and leak databases. Every sentence of its assessment links to the post and the file it came from.
30-minute call · your domain, once you authorize it · no obligation
Deduplication
This is what a breach search would have sent you about example-corp.com: fourteen hits from nine channels. EDG3 compares what is inside each file and ignores the filename. Underneath are three collections: two from the same infostealer campaign, and a third that is the first one repackaged and put up for sale again.
Same infostealer campaign as collection 1
Repackages collection 1 · 81% overlap
example-corp.com appears in three collections posted between March and July. Collections 1 and 2 probably come from the same infostealer campaign [1][2]. Collection 3 is collection 1 repackaged and resold, so it is not a new compromise [3]. Four employee accounts and two SaaS sessions in these logs may still be exposed [4].
The assessment
A short assessment your analyst could forward to the CISO unchanged. It answers seven questions, each with a confidence level and the evidence behind it.
EDG3 · Assessment · example-corp.com
Updated 2m ago
Evidence
Each statement in an assessment links to the post, the file and the line inside the archive it rests on. Where the evidence is thin, or two sources disagree, the assessment says so instead of guessing.
EDG3 · Assessment · example-corp.com
4 claims · 9 records
Sources for [1-3]
Confidence · highFirst post · collection 1
#v██████_logs msg 31877 2025-03-14 09:12 UTC
First post · collection 2
@lo██_cloud msg 40912 2025-05-02 21:17 UTC
First post · collection 3
#n████_market msg 39550 2025-07-19 22:41 UTC
Sources for [1][2]
Confidence · mediumOriginal file · collection 1
logs_mar_vip.zip sha256 a4f8…31c2
Original file · collection 2
combo_may_upd.txt sha256 7e10…9bd4
Shared marker
same stealer build tag in both 1,940 machine IDs in common
Sources for [3]
Confidence · highSource post
#n████_market msg 39550 posted 22:41 UTC collected 22:43 forwarded from @lo██_cloud
Original file
mix_premium_jul.zip sha256 d93b…0a57 preserved, never executed
Comparison
81% of records match collection 1 no record newer than Mar 14
Sources for [4]
Confidence · mediumArchive line
/EU/corp/passwords.txt line 18,204 j.r███@example-corp.com secret ●●●●●●●●
Archive file
/EU/corp/cookies.txt 2 session cookies example-corp SaaS apps
Record
4 accounts 2 sessions first seen Mar 14
Seller profiles
Leak sellers inflate their numbers, pass old dumps off as fresh and borrow each other's names. EDG3 keeps a profile of every channel and seller, built from what they actually post: aliases, channel moves, wallets and a timeline. What we observed, what they claimed and what we concluded sit in separate columns.
@lo██_cloud
Seller · active since 2023 · 2 channel migrations
Observed
Supported by collected evidence
Claimed
Said by the seller
Inferred
Concluded by EDG3, with confidence
Contradiction
"never sold before" vs. 81% overlap with the Mar 14 collection
EDG3 and CEM
C-Suite Exposure Monitoring finds which of your executives have exposed credentials and ranks what to fix first. EDG3 adds the story behind a finding: who posted the data, where it first appeared and who is selling it now.
CEM · J. Reeves · CEO
Updated 2m ago
EDG3 · same credential
4 sources cited
Origin: infostealer campaign, Mar 14
| Dimension | CEM | EDG3 |
|---|---|---|
| Starts from | your executives | what attackers publish |
| Answers | who is exposed, how badly | what happened, from whom, how sure |
| Delivers | a risk score per person, ranked fixes | a cited assessment with actor context |
| Watches | breach corpora and leak databases | the channels where stolen data is traded |
How it works
Collect
Messages, archives, documents, screenshots and other media from the channels and groups where stolen data is posted, with their source details.
msg 39550 · 3 files
Process
Text extraction, OCR, archive unpacking, normalization and deduplication. Every record keeps its provenance.
18,204 lines parsed
Profile
Aliases, channel moves, wallets and timelines for every seller, built from what they post.
@lo██_cloud · 2 aliases
Retrieve
Exact matching for emails, domains, hashes and wallets, plus search by meaning and by date.
3 collections linked
Questions
Where the data comes from, how a repost is told apart from a new leak and what the briefing involves.
EDG3 is threat intelligence for leaked data. It continuously collects what attackers post and sell in the channels and communities where stolen data is traded, works out which leaks are new and which are reposts, and explains what they mean for your domain, with a source for every claim.
From the channels, groups and communities where stolen data, stealer logs and combolists are posted and traded: messages, archives, documents, screenshots and other media. For every item, EDG3 keeps the channel, the message ID, when it was posted, when it was collected and a hash of its contents.
EDG3 links the copies. It compares the contents of each file with everything it has collected, so a dump that is renamed, repackaged or resold still traces back to the data it came from, and the assessment shows how the copies are connected and how much they overlap. The filename and the seller's description play no part.
CEM starts from your executives and tells you who is exposed and what to fix first. EDG3 starts from what attackers post and tells you where the data came from, how old it is and who is selling it. They are built to be used together.
EDG3 reports what it has collected, so a leak that never surfaced where it collects will not show up. It does not remove content from the places it watches, and it will not look at a domain until the customer has authorized it.
Once you have authorized it, a threat-intelligence analyst walks you through what EDG3 has collected about your domain: which leaks name it, which of them are reposts, who posted them and what may still be exposed. There is no obligation.
30 min · No obligation · [email protected]
EDG3 is a defensive security service. A domain is assessed only after its owner has authorized it. Findings can include credentials in clear text; they are visible only to authorized roles, and customers may use them only to protect their own organization and the people the data concerns, never to access third-party accounts, for resale or to screen individuals. Material posted by attackers can be incomplete or fabricated, and assessments are security findings, not legal advice. All names, channel handles, files and figures on this page are fictional examples. Full terms in our Disclaimer (EDG3, sections 11 to 17) and Privacy Policy.