Darknet intelligence, built for crypto
Payment addresses, not posts · Classified at the source · Often before first funding — Surikata-X Feed
Every darknet storefront needs a way to get paid. Using adversarial techniques that induce operators to expose their own financial infrastructure, Surikata-X collects the cryptocurrency payment addresses straight from darknet sites, attributes each one to the operator behind it, classifies it into one of 50+ categories, and keeps the source capture as evidence — often before the address receives its first transaction. Every address is checked against our 35K+ entity, 450M+ address attribution graph and delivered the way crypto teams already work: a screening API, attribution feeds, and evidence on demand.
Built for crypto, from the first crawl
The payment address is the unit
Every collection run ends in a payment address you can screen — not a post to read. 173,000+ so far, 14,000+ added in the last 30 days.
Chain-native from the start
Bitcoin, Litecoin and Monero at depth, with strict per-chain address normalization and entity tagging. Ethereum, TRON/USDT, Zcash, Dogecoin and Solana growing.
Before the chain knows
Addresses are collected from the storefront itself, often before they have any on-chain history for transaction analysis to see.
Delivered into crypto workflows
A yes/no screening API (about half a second per lookup, 10,000 per batch), attribution feeds, evidence on demand, and gateway monitoring for payment processors.
One feed. The whole illicit economy.
Surikata-X spans 50+ entity types — each address typed and jurisdiction-tagged. Bitcoin, Litecoin and Monero at depth, with Ethereum, TRON/USDT, Zcash, Dogecoin and Solana growing.
We start inside the darknet, not on the chain.
Chain analytics starts with an address and works backward through clustering and co-spend. We start at the source: inside the operator's own darknet site, and work outward to the crypto that runs it. The address is what we pull out, not where we start.
Scan the darknet
We continuously crawl protected .onion marketplaces, forums, and hubs to surface active operator sites as they come online.
Classify every site
AI content classification types each site by what it actually is — surfacing the crypto-adjacent, financially-active operators and dropping the non-actionable rest.
Get inside
Proprietary adversarial collection induces the operator to expose their own payment funnel — the step chain analytics never reaches.
Extract the addresses
We pull the crypto straight out of the operator's own funnel across BTC, ETH, Monero, TRON, Solana, LTC, and DOGE — taken from the source, not lifted off a page.
Attribute & cluster
Each address is tied to its operator and clustered by shared payment rails — mapping the network behind the money, not a single wallet.
Accuracy is a property of how the data is collected — not a scoring model applied after the fact.
Everyone scrapes the darknet. We keep it clean.
Adversarial collection makes attribution accurate at the source; crypto-native cleaning makes sure no noise reaches you downstream. We drop the donation addresses, the "key for sale" scams, and the wallets already labeled in our 450M-address graph — so what reaches you is the real money flow.
Illustrative sample. We drop donation and decorative addresses, "key for sale" scams and exit-scams, and addresses that are already-known entities (public treasuries, exchange wallets). What remains is high-signal — often flagged before first funding.
Proven on the hardest attribution there is.
CSAM networks are the most adversarial, most evasive corner of the darknet — where inference-based attribution fails most often. If a method holds up there, it holds up everywhere. The same adversarial collection and clean-signal pipeline runs across every entity type in the feed.
Surikata-X: 173,000+ payment addresses collected directly from darknet sites — 136,000+ tied to CSAM — each classified into one of 50+ categories with its source capture kept as evidence. See the full category breakdown →
Legitimate payment rails. Illicit users.
Darknet operators increasingly ride the same crypto-payment infrastructure real merchants use — Blockonomics, CryptoWoo, BTCPay Server, Apirone, Plisio, and dozens more. Because our adversarial collection reads each operator's own payment funnel, we catch the gateway signature at the source — the WordPress-plugin fingerprint, the widget script, the merchant-order API call — the moment it's embedded on a darknet site. We deliver those detections as a monitoring service, so payment processors know when their rails are being abused and investigators get a chokepoint upstream of the wallet.
We fingerprint the widget, plugin slug, and merchant-order API call inside the operator's own HTML — no third-party data, no chain heuristics required. Attribution is a property of where the payment funnel points.
Every detection ships with the operator's site, entity classification, extracted deposit address, and content-filtered HTML showing the exact widget embed. Suitable for internal risk-committee review or law-enforcement referral.
One subscription surfaces gateway abuse AND the pre-funding wallet alert via the same Surikata-X API. Cluster by shared merchant wallets across sites to map the network behind the operator, not just the single storefront.
Receive new detections as they land — filter by gateway, provider, entity_type, or specific counterparty. Zero-work integration for payment processors that want to be told the moment their infrastructure is being used by a bad actor.
Built for teams that need attribution, not alerts.
DarkScout is the data supplier, upstream of your stack — not the screening layer. We ship the data; you build the workflow.
Analytics & Threat-Intel Platforms
Supplement your attribution database with clean, darknet-sourced intelligence across every entity type — addresses detected before they appear in traditional datasets
Financial Institutions
Screen and attribute addresses pre-transaction to avoid exposure to the full illicit economy, not just one category
Law Enforcement & Investigators
Operator-level attribution with evidence, and network mapping across addresses and entities
Compliance & Risk Teams
Act before exposure, with attribution that often lands hours to days before first funding
How it works
Accurate at the source, clean by construction, multi-chain, and evidence-backed. Documented and auditable.
Proprietary techniques induce threat actors to expose their own financial infrastructure — accurate at the source, with full audit trails and content-filtered evidence
Crypto-native cleaning against a 35K+ entity, 450M+ address graph strips donations, scams, and known wallets — high-signal, low false positive
BTC, ETH, Monero, TRON, Solana, Litecoin, Dogecoin — most darknet intel tools are Bitcoin-only
Every address is backed by content-filtered screenshots capturing source and address only — suitable for compliance audits and legal proceedings
Evaluate the feed on your own data.
Request a data license and sample datasets to test attribution accuracy and clean-signal filtering across the entity types that matter to you.
Request Data License