# CyberPulse Dark Web Monitor

> CyberPulse Dark Web Monitor is a paid API for AI agents from cyberpulse-six.vercel.app, paid per call via x402, $0.2/call, status unknown (last checked 2026-09-15).

Surfaces dark web intelligence for a brand or domain including paste-site mentions, credential dumps, ransomware leak-site activity, forum chatter, brand impersonation, and initial-access-broker listings.

## Facts

- Endpoint: GET https://cyberpulse-six.vercel.app/api/cyber/dark-web-monitor
- Price: $0.2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cyberpulse-dark-web-monitor-54dfa51c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KM0rdLgHsOWMf_WpbwPC7

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cyberpulse-dark-web-monitor-54dfa51c
```

Example prompt: Can you run a dark web intelligence check on acmecorp.com — I want to know if there are any paste-site mentions, credential dump signals, ransomware leak-site hits, forum chatter, brand impersonation activity, or initial-access-broker listings tied to us?

## When to prefer this

Use this endpoint when you need underground/dark-web-specific intelligence about a brand or domain — particularly paste-site leaks, credential dumps, ransomware victim listings, IAB activity, and forum chatter — rather than surface-web or technical attack-surface signals. Prefer this over the domain breach history endpoint when you need real-time underground forum and leak-site coverage beyond historical breach databases, and over the external attack-surface endpoint when the focus is on adversarial chatter and data exposure rather than technical vulnerabilities.

## Known failure modes

- Domain or brand not recognized — returns empty or minimal results
- Rate limiting or quota exceeded — HTTP 429 response
- Payment not processed correctly — HTTP 402 response
- Invalid or missing query parameter — HTTP 400 response
- Upstream OSINT data sources temporarily unavailable — partial or degraded results
- No dark web activity found — returns empty intelligence set (not an error)

## How this service works

Dark-web monitoring for any brand or domain — paste-site mentions, credential-dump signals, forum chatter, ransomware leak-site activity, brand impersonation, and initial-access-broker listings, for threat-intel and brand-protection agents. Ethical OSINT only.

## Output

Returns structured dark web intelligence for the queried brand or domain, including paste-site mentions with context, credential-dump signals, ransomware group leak-site references, underground forum chatter summaries, brand impersonation indicators, and any initial-access-broker listings — enabling threat-intel and brand-protection workflows.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "lang": {
       "type": "string",
       "description": "en | es | fr | de | ja | zh | ko | pt | ar | hi (default: en)"
      },
      "brand": {
       "type": "string",
       "description": "Brand name or domain to monitor — e.g. \"Acme Corporation\" | \"acme.com\" | \"MyBank\" | \"startupname.io\""
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "errors": {
     "type": "object",
     "description": "Documented error responses, keyed by HTTP status code",
     "additionalProperties": {
      "type": "object",
      "required": [
       "description"
      ],
      "properties": {
       "example": {
        "type": "object"
       },
       "description": {
        "type": "string"
       }
      }
     }
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "target": "acme.com",
  "signal_summary": {
   "paste_site_mentions": true,
   "data_for_sale_signals": false,
   "forum_chatter_detected": false,
   "credential_dump_mentions": false
  },
  "brand_impersonation": {
   "impersonation_examples": [
    "acme-login.com",
    "acmecorp-support.net"
   ],
   "phishing_domains_registered": true
  },
  "credential_exposure": {
   "credential_freshness": "Stale (> 1 year)",
   "combo_list_appearances": 3,
   "estimated_exposed_accounts": 2500
  },
  "recommended_actions": [
   "Register defensive domain variations",
   "Enable dark web monitoring alerts",
   "Force password reset for accounts in known combo lists"
  ],
  "overall_exposure_level": "MEDIUM"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cyberpulse-dark-web-monitor-54dfa51c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from cyberpulse-six.vercel.app](https://www.zero.xyz/host/cyberpulse-six.vercel.app/llms.txt)