Threat intelligence infrastructure
The dark web, read continuously.
Aarvi AI crawls 4.1 million onion sites around the clock, then turns what it finds — leaked credentials, actor chatter, infrastructure, indicators — into evidence your analysts can put their name on.
- Sites indexed
- 4,118,402 sites
- Collection window
- 24/7 crawl
- Deployment
- GCP · Oracle Cloud
- Sites indexed
- 4,118,402+
- Channels
- 3
- Crawl window
- 24/7
- 04:11Ransomware leak site · new victim entryindustry: manufacturing · region: EUonion
- 04:07Channel post containing a domain list412 domains · actor alias matchedtelegram
- 03:58Access broker listingVPN appliance · ask: 2,400 USDonion
- 03:44Credential dump · forum thread1,208 lines · corporate mailonion
Illustrative extract. Records are redacted; the live index is available under access.
Sentinel V2 and Laya DCO, the log-analysis models, are planned rather than live. The models below are labelled for the same reason.
- 4.1M+
- dark web sites indexed
- 24/7
- collection window
- 6
- intelligence workflows
- 4
- in-house models
and counting
continuous crawl
one console
owned, not rented
One case, end to end
From a paste nobody noticed to a decision you can defend.
This is a single invented case, followed from the crawl that found it to the reset it triggered. Four stages, the same record throughout — it is the shortest honest description of what the platform does.
Stage 1 of 4: Signal
Stage 01 / 04
What did the crawler see, and when?
A paste appears at 03:44 UTC. The page is captured before any model reads it: source category, fetch job and capture time are recorded with the raw text, so the record can be re-read later without depending on the site still existing.
- Capture
- 2026-10-14 03:44:12 UTC
- Fetch job
- crawl-7f21
- Source
- paste · clearnet mirror
- Volume
- 1,208 pairs
- 03:44Paste · credential dump1,208 pairs · no title · 11.4 KB
- 03:44Raw text stored, hash recordedsha256 6d1a…c39f · extractor v4
- 03:45Entities queued for extractiondomain · email · alias
Fig. 01 — Collection ledger, one capture. Timestamps are the record's, not the page's.
Illustrative case · invented records, redacted the way live output is.
Position
A search box is the easy part. Knowing what a record means, and being able to defend that reading six months later, is the work.
Every record Aarvi returns keeps its source URL, the job that fetched it and the moment it was captured. When a claim is challenged in a board meeting or an incident review, the evidence is one click away — not a screenshot in a slide.
The same layer answers three different questions: what is exposed right now, what is being said about us, and what does it mean. One corpus, one evidence model, three ways in.
The engine
Four models, owned end to end.
Nothing in the pipeline hands your telemetry to a general-purpose API and asks it to guess. The models are ours, trained for this, and versioned.
Sentinel V2 reads device and service logs. Laya DCO makes the call about what deserves an alert. Nano V2.1 writes the context an analyst reads — on an alert, in a summary, inside a report. Nano V1.2 does the unglamorous work that decides whether a dark web search finds anything at all.
Two of them are built. Two are planned. The table says which, because a roadmap you cannot check is a brochure.
| Model | Params | Role | Status |
|---|---|---|---|
| Sentinel V2 | 35B | Log analysis. Reads normalised device and service telemetry and names the behaviour it thinks it sees. | Planned |
| Laya DCO | — | Decision orchestration. Decides whether an observation becomes an alert, stays correlated, or is dropped. | Planned |
| Nano V2.1 | — | Intelligence summaries, alert context and report synthesis. The model writing every report section. | Built |
| Nano V1.2 | ~2B | Query expansion. Turns one analyst phrase into the variants a dark web search actually needs. | Built |
Parameter counts are stated only where confirmed. “Built” describes the model artifact, not deployment readiness in a customer environment.
Coverage
What is actually in the index.
Collection is a maintenance problem before it is a modelling problem. These are the six corpora behind every answer the platform gives.
- 01
Dark web sites
4.1M+ indexedForums, marketplaces, paste dumps, leak pages and directories. Each capture is dated so freshness is never implied.
- 02
Threat actors
aliases · campaignsActor records with aliases, associated infrastructure, posted material and the campaigns they appear in.
- 03
Indicators
domains · IPs · hashesExtracted from collected content and verified feeds, with first-seen, last-seen and the source that asserted it.
- 04
Telegram
configured sourcesMonitored channels and groups, collected and indexed so a query never depends on a live scrape.
- 05
Leak sites
ransomware victim pagesVictim entries, claims and deadlines, linked to the actor that published them.
- 06
Open sources
news · advisories · recordsVulnerability news, public advisories and registries used to corroborate what the closed sources claim.
How it runs
Collection to conclusion, in four moves.
The same four stages serve a live search, a scheduled watch and a researched report. Only the entry point changes.
- 01
Collect
Source jobs run continuously: onion sites, Telegram channels and open sources. Every page keeps its URL, capture time and the job that fetched it.
crawler · source registry · job queue
- 02
Normalise
Entities, indicators and timestamps are extracted, duplicates collapse, and each record is linked back to the raw capture it came from.
extraction · dedupe · provenance
- 03
Reason
Models read the evidence: Sentinel V2 over telemetry, Laya DCO over decisions, Nano V1.2 over the analyst's phrasing, Nano V2.1 over what it all means.
Sentinel V2 · Laya DCO · Nano
- 04
Deliver
An alert with linked events, a search result with highlighted matches, a scheduled monitoring report, or a researched report in your inbox.
console · email · exports
Each stage names the component that does the work, because “AI” is not an architecture.
Two products, one fabric
An engine you do not see, and a console you do.
Aarvi AI is the collection and reasoning layer. Aarvi Intelligence is the workspace built on it. They share one record, which is why a finding looks the same wherever you meet it.
Aarvi AI · the engine
Aarvi AI
Collection and models. The crawler, the corpus, the four models and the evidence record every answer inherits.
- Corpus
- 4.1M+ sites · 24/7
- Models
- Sentinel · Laya · Nano ×2
- Storage
- GCP · Oracle Cloud
Aarvi Intelligence · the console
Aarvi Intelligence
The workspace on top. Alerts, investigation, monitoring and reports, all reading the same evidence record.
- Workflows
- 6 entry points
- Channels
- live · indexed · Telegram
- Delivery
- console · email
The product
Four views, one evidence model.
Alerts, investigation, monitoring and reports are four ways into the same record. Switch between them below — the sample data is invented, the structure is what ships.
Aarvi Intelligenceone evidence model · three search channelsAlert queue
3 open · 1 assigned- HighRepeated failures, then a successful loginALR-1042 · finance-app-02 · Needs review04:02
- MediumUnusual application access outside baselineALR-1041 · app-gateway-01 · Investigating03:47
- LowUnexpected service restart on a worker nodeALR-1040 · worker-03 · Needs review03:12
Illustrative interface. Records are invented; no customer data is shown.
Four console views on illustrative data. Every view cites the capture it came from.
One evidence model
An alert, a search hit and a report section cite the same capture.
Three search channels
Live dark web, indexed dark web, and Telegram — never confused.
Human in the loop
AI proposes. An analyst confirms, dismisses or asks for more research.
Workflows
Six jobs, one corpus.
Each workflow can stand alone. None of them work without the collection layer underneath it.
- 01SIEM & intelligent alertingDevice telemetry becomes an evidence-backed alert, a human decision and an audit trail.logsSentinel V2Laya DCO
- 02Continuous threat intelligenceAlways-on collection builds the IOC, actor and campaign corpus that everything else reads.crawleractorsIOCs
- 03Live dark web investigationOne phrase becomes an expanded query plan, a fresh crawl and highlighted findings.Nano V1.2orchestratorlive
- 04Indexed & Telegram searchFast retrieval from what has already been collected, with capture times attached.dwsearchTelegramindexed
- 05Monitoring & Info CardsA watch subject, searched daily, weekly or monthly across three channels, delivered by email.schedulesInfo Cardsemail
- 06Researched reportsA twenty-word brief becomes a structured, cited report on a twenty-to-thirty minute target.Nano V2.1verificationemail
Free report
Start with one question about yourself.
Before a conversation about deployment, run a single query. You get the summary, the severity split and redacted samples, and we get to show you the corpus instead of describing it.
No card, no call required. Twenty to thirty minutes is a target, not a promise.
- 01Describe the questionUp to twenty words: a domain, a brand, an entity you care about.
- 02Collection runsThe brief becomes a query across the indexed corpus, with the matches cited.
- 03A report arrivesExecutive summary, severity split and redacted samples, by email.
Access
Bring the question your current tools cannot answer.
Access begins as a short conversation: what you need to watch, how your team already works, and what a useful report looks like on your desk.
No self-serve trial. Data handling and deployment are agreed before collection begins.