Cybercrime investigation platform
DeXpose pivots through stealer logs, breaches, hacking forums, onion sites, Telegram and more than 800 OSINT sources, with an AI agent that proposes the next move, until the operator's devices, accounts and associates sit on a single graph, every node with its source and date.
Start from a Telegram handle
Offered to law enforcement, government agencies, qualified organisations and vetted cybercrime investigators.
Emails, phones, usernames, passwords, device IDs, Telegram IDs, names and images become nodes, each edge coloured by how the link was made. The investigator drives the case; the agent proposes, runs and summarises, and nothing it adds counts until it has been reviewed.
Reads the graph and suggests the moves most likely to connect an alias to a person, a device or a channel. You choose what to run.
Give it one identifier and the correlations and cross-source lookups execute in sequence while the graph fills in. Every addition is listed for review before it counts.
Emails and phones, usernames and names, passwords and devices, Telegram IDs and groups, images.
Every node and edge in sequence, separate lines of inquiry in groups, and the canvas stripped to the part you are working on.
Graph export with the source and date of every node, device log export, CSV credentials, and import of existing material.
What the stealer took, which credentials still matter and which identities share the infection, ready for the case file.
Compromised devices are searchable by country, category, infrastructure and credential. Open one and you get the machine, the infection, every artefact the stealer took and the identities it links to.
Three more modules share the same corpus and the same graph. Every result they return can become a node in the workspace.
Enter an email, domain, IP, phone or username and get every match from infostealer logs, ULP dumps, combo lists, public breaches, compromised machines, malware log files, hacking forums, intel feeds, onion sites, Telegram messages and channels, grouped by where it was found.
Deep identity scan resolves one identifier into the accounts, platforms, locations and linked contacts behind it, drawing on more than 800 OSINT sources alongside the DeXpose corpus. Sensitive values stay masked until you open them.
Stealer logs, combo lists and access are sold in Telegram channels before they ever reach a forum. DeXpose indexes messages, channels and groups so an investigator can search them by keyword, username or ID, profile a channel and its members, and de-anonymise the users behind a handle: the phones, emails, usernames and devices that connect a Telegram account to a person or a threat actor.
The platform ships with further modules, from intel feeds to infrastructure and brand monitoring, and new ones are added as investigations demand them. Ask about the full module list
ResearchHow the DeXpose team attributes threat actors, developers and infrastructure with the same platform, in public reports. The intel feed of ransomware attacks and breaches runs inside it too.
A high-volume database and access broker, not a single-campaign actor: activity across more than 40 countries and around 160 threads since late 2023.
Attribution of the Argentinian developer behind the Valkyrie, Prysmax and Packit stealers and several RATs.
One commit exposed the actor behind a 2026 campaign against Egyptian airlines, industry and government targets.
Hunting APT43 infrastructure with JARM, TLS and HTTP header fingerprints to uncover phishing domains and espionage tooling.
Read more investigations on the blog See the public intel feed
Four stages, one workspace. Every record you touch carries its source and collection date from the first query to the exported case file.
Enter an email, domain, IP, phone or username. One query returns matches from every source, grouped by where they were found.
Open the compromised device, the identity or the Telegram channel behind a match, and follow the correlations it exposes.
Send findings to the workspace as nodes, order them on the timeline, group leads, and let the AI agent propose the next moves or run them on autopilot.
Export the graph and the device logs with the source and date of each record, ready for the case file.
The platform is offered to law enforcement agencies and qualified organisations with a lawful mandate to investigate, and to individual cybercrime investigators through beta access. Access is reviewed, usage is metered, and every record keeps its provenance.
Request accessCoverage, access and evidence, in plain terms.
Law enforcement agencies, government bodies and qualified organisations with a lawful mandate to investigate, and individual investigators or researchers who work cybercrime cases, through beta access. Requests are submitted through the access form and reviewed for professional use before an account is created.
Infostealer logs, ULP dumps, combo lists, public breaches, compromised machines, malware log files, hacking forums, intel feeds, onion sites, Telegram messages and Telegram channels. A single query returns matches from every source, grouped by where they were found.
Yes. Deep identity scan takes a phone number, an email address or a username and resolves it into the accounts, platforms and locations behind it, with an optional OSINT scan over more than 800 sources. Global search accepts emails, domains, IPs and usernames.
From stealer logs and combo lists traded on dark web markets, forums and Telegram, from public breach corpora, and from onion sites and hacking forums that DeXpose indexes continuously. Each record carries its source and collection date.
Yes. The investigation graph exports with its evidence, each compromised device has an export for its full log, and credential tables export as CSV, so findings can be attached to the case file.
Tell us about your agency, organisation or practice and the investigations you run. We review every request and set up access for approved teams and investigators.
