How We Research Threats

No single feed. Our agents pull from certificate transparency logs, newly registered domain feeds, passive DNS, and the attack surfaces of the organizations we protect. On the criminal side we monitor dark web forums and marketplaces, Telegram channels where stealer logs and combo lists circulate, phishing kit repositories, and public breach corpora. We also take reports from customers, CERTs, and anyone who emails us.

Coverage is continuous, not periodic. A phishing domain registered at 3am gets seen at 3am, because the campaign it hosts won't wait for business hours. Most of the phishing infrastructure we take down is under 48 hours old when we first flag it.

One honest limit: nobody sees everything. Private broker deals and invite-only channels are, by design, hard to observe. We'd rather tell you that than pretend otherwise.

Every finding goes through two gates. First, automated scoring: our agents collect screenshots, WHOIS records, hosting and DNS evidence, page content, and behavioral signals, then score how confident we are that something is a genuine threat. Second, for anything that triggers a takedown request or a customer escalation, a human analyst reviews the evidence. Suspicion alone never gets a site reported.

Why so careful? False accusations burn trust with registrars and hosts, and that trust is what makes our next hundred takedowns fast. It's also just wrong to get a legitimate site suspended. When we're not sure, we watch and wait.

A takedown is an evidence package, not an angry email. For each confirmed threat we assemble the screenshots, WHOIS data, hosting records, and the specific policy or law being violated, then file with the party best positioned to act: the registrar, the hosting provider, the CDN, the platform, or a national CERT. Filing with the wrong abuse contact is the single most common reason takedowns stall, so routing is half the craft.

We don't stop at the first filing. Requests get tracked, chased, and escalated until the threat is gone, and the infrastructure stays on watch afterwards, because kit operators re-register. Fast responders act within hours; slow ones take weeks. Our takedown service exists because most security teams don't have the time to run that loop themselves.

Threats we can't remove, like listings deep in Tor marketplaces, we monitor and help customers respond to instead: rotate the credentials, close the exposure, notify the people affected.

We don't buy stolen data. Our dark web collection is passive observation of what criminals have already published or offered for sale. We don't hack back, we don't engage sellers, and we don't access systems we're not authorized to access. Customer data stays inside our ISO 27001 certified environment, and our own practices are documented on the compliance and security page.

When we find data belonging to someone who isn't a customer, we make a reasonable effort to notify them or the relevant CERT. It's the response we'd want if the situation were reversed.

Everything on the Hunto blog and in our resource library is written or reviewed by practitioners who do the work described, under a named byline with a real author profile. Claims about attacker behavior come from what we observe in our own monitoring and takedown operations. Claims about laws and standards, like India's DPDP Act, are checked against the primary text, and we revisit that content when the rules change, as they did with the DPDP Rules in 2025.

We don't publish undisclosed AI-generated filler, and we don't accept paid placements dressed up as research.

Got something wrong? Tell us. We correct errors in place, note the correction on the page, and update the modified date. Write to [email protected] and reference the page URL.

If you've spotted a phishing site, a brand impersonation, or leaked data, we'll look at it whether or not you're a customer. Send it to [email protected]. For security issues in Hunto's own products, contact [email protected] and we'll acknowledge within two business days. Good-faith research is welcome here.