Q4 2025: Product Updates and Highlights

February 04, 2026

As we have wrapped up Q4, we’re excited to share major updates to our DarkOwl Vision product suite. Below we highlight some of the most exciting feature updates and launches. These enhancement and net new features reflect our commitment to providing continued value to our partner, clients, and the cybersecurity community. We look forward to what is in store in Q1 of 2026!

Market Features

Understanding darknet marketplaces is critical for identifying emerging threats, monitoring illicit activity, and staying ahead of the evolving cyber‑risk landscape. DarkOwl’s Market Explore feature delivers an intuitive experience to dive deep into our enhanced darknet marketplace dataset. We now have 81 markets, with more than 387,651 listings and 16,225 vendors in our enhanced market listing DarkMart database.

Dataset Visualizations at a Glance

At the top of the Market Explore page, you’ll find a set of visualizations that help you quickly understand:

Overall listing volume and vendor activity
Top shipping sources by listing count
Darknet markets and vendors with the highest activity levels

Selecting View Charts expands the charts into a full‑screen visualization experience, where you can explore trends like:

Enhanced Markets by Topic
New Listings Over Time
Shipping Sources Across the Entire Dataset

Comprehensive Market Overviews

Each market’s Overview page provides a snapshot of marketplace activity:

Total Listings: Unique listings available within our dataset
Total & Top Vendors: Overall vendor count and top vendors ranked by listing volume
Top Shipping Source: The region shipping the highest volume of listings
New Listings Over Time: Daily/weekly/monthly visual trends
Shipping Sources Map: Color‑coded visualization from highest volume to lowest

Additional analyst‑curated information may include Market Descriptions, Currencies Accepted, Admin Handles, Contact Information (emails, Jabber servers, PGP keys). If a PGP key exists, users can reveal and copy it with a single click. You can also jump directly from the Overview into the Markets Research section to further investigate specific listings.

Enhanced Marketplace Research Features

Building on the launch of DarkOwl’s Enhanced Marketplace Research in Q3, the team added several Research features: support for Findings, Search Blocks, and Site Context. Additionally, we have completed currency normalization for prices in market listings, allowing for Sort by Price features.

Paste Search + New Features

Search results from selected paste sources have a new look + improved searchability. Paste results (more than 40 million documents) are now eligible to be returned when you filter by Post Date or Username in both Vision UI or Vision API. If available, Paste Authors are shown on the top of a UI search result and include a pivot link, just like Forum Post Authors or Market Vendors.

Export Case Findings

We launched our Findings Export feature for Cases, allowing our users to bulk export important results out of Vision UI into Word, CSV, or JSON. It makes sharing reports and moving data out of Vision UI faster and easier. This was a top feature request from our customers and we are thrilled to have delivered on this ask!

Other Enhancements for UI + API Users

To more easily filter our noisy sites, or data leaks you’ve already seen, we’ve added an “Exclude this Source” option on the Vision UI search result table.

We added 9 new actors to our Actor database in Q4. Additionally, Actor Explore and Actor API now include associated Sites in the Darknet Fingerprint tab.

Collection Stats

Highlights

Quarter after quarter, our data collection team continues to astonish us with the quantity of data made available across DarkOwl products. Let’s highlight just some of that growth:

6% increase in credit card numbers
2.5% increase in IPs
5% increase in data leak records

Leaks of Interest Collected

When your search results are from data leaks, users can review additional information curated by DarkOwl analysts, giving you enrichment on the data leak. The descriptions below are all available in our Leak Explore UI feature, or Leak Context API endpoint.

Ryanair Internal Communications

Data purported to be from RYANAIR was posted on DarkForums, a hacking forum, on November 19, 2025. According to the post, the data breach includes email addresses, ticket bookings, travel details (departures, destinations), flight numbers, and ticket claimants. Data exposed includes names, email addresses, internal documents, company names, and internal emails.

IRAN IP NETWORK INFRASTRUCTURE

A post on DarkForums, a hacking forum, on August 22, 2025 linked to the file: iran-net-100k.json. According to the post, the “Caucasian Brotherhood” leaked a dataset of Iranian network information that included IP addresses, open ports, software versions, and DNS records. Data exposed includes countries, IP addresses, and locations.

Farm Credit Union Of Colorado Bank

Data purported to be from Farm Credit was posted on BreachForums, a hacking forum, on September 8, 2025. Data exposed includes names, customer information, physical addresses, online profiles and user identification number (UID).