Investigate dark-web activity, stealer logs, credential exposure, exposed assets, vendor risk, and IOCs with source evidence attached. Prepare authorized company requests through LERS.
A 30-minute session built around your own workflow.
Historical coverage snapshot
Domain exposure check
See whether logins for your domain have been stolen by infostealer malware, and how recently.
Employee, customer, and third-party logins found in infostealer records and underground activity, with last-seen dates.
Free, no account. Check only a domain you own, control, or are authorized to assess. Terms and privacy details apply.
THE INVESTIGATION WORKFLOW
Find the signal. Understand the connection. Give your team the evidence to act.
Discover identity, dark-web, asset, and vendor signals with their original sources.
Explore intelligenceConnect identities, assets, indicators, and source records before deciding what needs review.
Explore investigationsPrioritize findings and hand off authorized intelligence to your team’s workflow.
Explore evidence reviewConnect external evidence in one investigation workspace, then keep authorized company requests organized with LERS. Access to each intelligence source and request workflow depends on your plan and account permissions.
Investigate stolen credentials, browser sessions, infected-device context, and the identities tied to each exposure.
Illustrative scenarioAn employee's SSO password and saved browser cookies in a stealer log, with the infected machine's country and infection date.
Search leak records, underground discussions, actor activity, and historical evidence without breaking the investigation flow.
Illustrative scenarioA forum thread selling access to your VPN, or your domain appearing in a newly posted leak.
Map domains, hosts, certificates, technologies, vulnerabilities, and exposed services back to the assets that matter.
Illustrative scenarioA forgotten staging host with an expired certificate, running a software version with a known CVE.
Monitor vendor posture, factor changes, issue history, breach exposure, and infostealer impact in one detailed view.
Illustrative scenarioA supplier whose security posture drops after new infostealer infections among its staff.
Enrich IPs, domains, URLs, and hashes, then pivot through the entities, infrastructure, malware, and campaigns around them.
Illustrative scenarioAn IP from a firewall alert, resolved to the malware family and infrastructure it belongs to.
Review structured source records and export authorized risk lists or fusion files. Full-log ZIP appears only for qualifying leak and stealer records.
Illustrative scenarioA risk list of malicious IPs for your firewall, or the full log behind one qualifying stealer record.
LERS · Law Enforcement Request System
Keep company requests, case details, legal documents, and activity history in one controlled workspace. Optional AI helps draft the summary; human review stays in charge.
Enabled per account. Company destinations and delivery channels are configured by an administrator.
Select the organization, define the request scope, and attach the supporting documents.
Check the request and its summary through a separate administrative review.
Use an approved, configured delivery channel or manual portal handoff, with the case history kept together.
Move from a noisy external signal to the internal context needed for a decision—without rebuilding the investigation in five tabs.
Move across infrastructure, actors, malware, campaigns, and historical records while preserving every step of the analytical trail.
Surface compromised credentials, browser data, device context, and exposed applications before they become separate fraud cases.
Factor-level history, issue detail, leaked-credential exposure, and the applications affected across the relationship.
Monitor brand, executive, and corporate-identity exposure across leak records and underground activity, with the source record kept alongside each finding.
Organize identifiers, legal documents, and request scope in LERS, then move through human review and the configured company handoff.
Stealer logs and leak records hold other people's credentials. These controls are built into the XTI workspace.
Read the security approachThere is no public sign-up. An administrator invites every user, and admin tools require an admin role.
Sensitive modules such as dark-web search are enabled account by account, and the server enforces it rather than just hiding a menu.
Changes and searches against paid sources are recorded against a hashed user ID. Request bodies are never stored in full, and clearing the log is itself recorded.
Full-log ZIP downloads exist only for qualifying leak and stealer records. Everything else exports as a risk list, fusion file, or report.
How this site handles your data, the terms that apply, and how to report a vulnerability.
For individual analysts and lean security teams building a focused external-intelligence workflow.
For security teams that need broader investigations, connected evidence, and repeatable intelligence workflows.
For teams that need the highest self-serve FireIntel tier across wider intelligence and investigation workflows.
For teams ready to operate a dedicated FireIntel XTI workspace across advanced intelligence workflows.
Self-serve purchases continue to the plans portal. Enterprise requires a minimum three-month license. The DDW Search Add-on is separately scoped and available with an annual XTI license.
Need to map FireIntel to a specific workflow or control requirement?
Read the intelligence guideFireIntel is designed around the external footprint of your organization: domains, hosts, certificates, technologies, vulnerabilities, brands, executives, corporate identities, and third-party relationships. Scope is configured around the assets and identities relevant to your team.
Licensed commercial threat-intelligence feeds, a searchable index of dark-web, leak, and stealer-log data, and open sources such as public vulnerability databases. What a workspace can search depends on its plan, and freshness varies by source.
No. FireIntel adds the external evidence those systems usually cannot see, then helps your team connect it to an identity, asset, vendor, or response decision. It is built to complement—not replace—your internal security controls.
Each vendor view combines posture, factor changes, issue detail, historical movement, and exposure signals. That gives analysts a deeper explanation of risk than a single grade or score.
No. The DDW Search Add-on is available only with an annual XTI license. It provides unified search across a rich, multi-source intelligence ecosystem, backed by over a decade of historical data. Current coverage and entitlement are confirmed during the enterprise evaluation.
Accounts are invite-only, sensitive modules are enabled per account and enforced by the server, changes and paid-source searches are written to an audit log, and full-log exports are limited to qualifying records. Retention and scope can be aligned to the deployment.
Yes. Plans can include API access and workflow integration so findings can move into the systems your SOC, identity, fraud, and risk teams already use.
LERS is the FireIntel Law Enforcement Request System for preparing, reviewing, and tracking authorized company requests. Access is enabled per account by an administrator. Optional AI helps draft a summary; people review it. Delivery depends on the configured company destination and approval, and portal requests require manual handoff. LERS does not guarantee company acceptance or disclosure.
Tell us the outcome you need. We use it to focus the walkthrough on the external evidence, investigation paths, and controls relevant to your team.
A focused product walkthrough, clear answers on deployment and controls, and no obligation to proceed.
We use this context only to prepare and respond to your request.
