# CyberPulse Dark Web Monitor

> CyberPulse Dark Web Monitor is a paid API for AI agents from cyberpulse.theaslangroupllc.com, paid per call via x402, $0.2/call, status unknown (last checked 2026-09-15).

Scans dark web sources — paste sites, credential dumps, hacker forums, ransomware leak sites, brand impersonation, and IAB listings — for mentions of a given brand or domain.

## Facts

- Endpoint: GET https://cyberpulse.theaslangroupllc.com/api/cyber/dark-web-monitor
- Price: $0.2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cyberpulse-dark-web-monitor-a075db20
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_QLH7qzIca2OgSsQAHrQ6R

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cyberpulse-dark-web-monitor-a075db20
```

Example prompt: Run a dark web monitor scan on acmecorp.com — I want to know if it shows up on any paste sites, credential dump signals, ransomware leak sites, hacker forums, or initial-access-broker listings.

## When to prefer this

Choose this endpoint when you need dark-web-specific threat intelligence for a brand or domain — particularly paste-site exposure, credential leak signals, ransomware victim listing checks, IAB activity, or brand impersonation on underground forums. Prefer this over surface-web OSINT or CVE/vulnerability endpoints when the threat vector is data exfiltration, credential theft, or underground marketplace activity rather than technical vulnerability scanning.

## Known failure modes

- Invalid or malformed domain/brand input returns a 400 error
- No dark web results found for the queried entity returns an empty or null findings payload
- Payment not processed (x402 protocol failure) results in a 402 response
- Rate limiting or quota exceeded returns a 429 error
- Upstream OSINT source unavailability may result in partial or degraded results

## How this service works

Dark-web monitoring for any brand or domain — paste-site mentions, credential-dump signals, forum chatter, ransomware leak-site activity, brand impersonation, and initial-access-broker listings, for threat-intel and brand-protection agents. Ethical OSINT only.

## Output

Returns dark web intelligence findings for the queried brand or domain, including paste-site mentions, signals of credential dumps, underground forum chatter, ransomware leak-site activity, brand impersonation indicators, and initial-access-broker listings — all scoped to ethical OSINT sources.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "lang": {
       "type": "string",
       "description": "en | es | fr | de | ja | zh | ko | pt | ar | hi (default: en)"
      },
      "brand": {
       "type": "string",
       "description": "Brand name or domain to monitor — e.g. \"Acme Corporation\" | \"acme.com\" | \"MyBank\" | \"startupname.io\""
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "errors": {
     "type": "object",
     "description": "Documented error responses, keyed by HTTP status code",
     "additionalProperties": {
      "type": "object",
      "required": [
       "description"
      ],
      "properties": {
       "example": {
        "type": "object"
       },
       "description": {
        "type": "string"
       }
      }
     }
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "target": "acme.com",
  "signal_summary": {
   "paste_site_mentions": true,
   "data_for_sale_signals": false,
   "forum_chatter_detected": false,
   "credential_dump_mentions": false
  },
  "brand_impersonation": {
   "impersonation_examples": [
    "acme-login.com",
    "acmecorp-support.net"
   ],
   "phishing_domains_registered": true
  },
  "credential_exposure": {
   "credential_freshness": "Stale (> 1 year)",
   "combo_list_appearances": 3,
   "estimated_exposed_accounts": 2500
  },
  "recommended_actions": [
   "Register defensive domain variations",
   "Enable dark web monitoring alerts",
   "Force password reset for accounts in known combo lists"
  ],
  "overall_exposure_level": "MEDIUM"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cyberpulse-dark-web-monitor-a075db20/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from cyberpulse.theaslangroupllc.com](https://www.zero.xyz/host/cyberpulse.theaslangroupllc.com/llms.txt)