Underground monitoring coverage, community activity and the account histories behind the intelligence — collected by governed connectors that never engage with actors.
The screen
Built on the same preserved evidence as every alert and perspective. Open the live demo
Coverage by community, seller credibility and account histories give every listing the context an analyst needs to decide what the evidence can actually support.
Direct answers on scope, evidence, safety controls and how ThreatCanary differs from tools you already run.
No. Collection is observation only. Nullstar never messages, negotiates, purchases, transacts or validates credentials, and models never initiate or trigger contact with actors. Some sources hide content behind a fixed action; where one is taken it is scripted, limited, logged, approved in advance and can be switched off at once.
From the preserved record of how an account has behaved over time — its history across communities, consistency and prior claims — rather than from the reputation a marketplace displays. Analysts record the decision and rationale on each claim they validate.
No. The workspace never renders images from collected content, and collected material is validated before it is processed or shown.
