Is your company on the dark web?

What does this search read?

The documents that ransomware groups published: invoices, contracts, purchase orders, emails and more. They publish on sites and forums of their own. The sites have .onion addresses, which is what most people call the dark web.

OwlyScan indexes these documents. You type a company name, a domain or a part number, and the search looks for it in the text.

It reads only what is already public, never your systems. And it covers what OwlyScan has indexed, not everything that exists.

What do I see for free, and what stays hidden?

No account. Each search shows how many records match, by kind, and a list of matches. Each match shows:

• the kind of document and its format;
• the channel it was published on, and the date it was indexed;
• the start of the site’s .onion address;
• your words in context, with up to three ordinary words on each side.

The rest is hidden, and names stay hidden.

You get 3 searches a day. They come back at midnight UTC, and repeating a search you already ran today does not use one.

To read your own records as they are, you need Access. Other companies’ records keep their names hidden. Try Access free for 7 days, then €39 a month, excl. VAT.

How the free search works →See pricing →

My company is not on any victim list. Can it still appear?

Yes. When a ransomware group publishes a supplier’s files, the supplier’s customers are in them: invoices, purchase orders, emails. Your company can appear in files that were never its own.

We counted it once, on one publication. In the files of one business-services supplier, published by a ransomware group in 2026, 99 of the 104 large groups on our list appear by their e-mail or web domain.

That does not say those groups were attacked: the supplier was. It says a victim list is not the only place your company can appear.

How we counted →What to do when a supplier is hit by ransomware →

What does an empty result mean?

It means no record in the index matches your words today. It does not prove that nothing was published about your company.

The index holds what OwlyScan has indexed from ransomware sites and forums, not everything that exists. A document may spell your company’s name differently, and new documents are indexed over time.

Try the name as written on your invoices, a shorter form or your domain, and search again later.

What should I do if my company appears?

A match is a reason to look closer, not proof of an attack on you.

1. Read the matches. Look at the kind of document, the channel and the date it was indexed.
2. Find whose files they are. A match can come from a supplier’s published files. Ask the supplier whether it has reported an incident.
3. Tell the people in charge. Give your security or legal contact the dates and the kinds of documents, and decide the next step together.

Access shows your own records as they are. If your company itself is hit by ransomware, Incident watch is the optional add-on made for that day.

See your own records with Access →How Incident watch works →Ransomware group published your data: what to do →

How does it work, in three steps?

1. Search. Type your company’s name, as written on your invoices.
2. Read the result. See how many records match, by kind, with the date each was indexed and the names hidden.
3. See your own records with Access. Create it with your work email to read the records that concern your company, in the app, with your AI or through the API.

Questions and answers