
Featured
Which IP addresses do AlienGate scans come from?
AlienGate's vulnerability scans come from a fixed set of 125 IP addresses. Allow them on your firewall or WAF before you scan, or the results will be incomplete.
[ Blog ]
Field notes from the underground
What our intelligence team finds in stealer logs, leak sites and darknet markets, written up while it still matters. No vendor fear, no recycled headlines.
64
Research
1,849
Sources
Weekly
Publishing

Featured
Which IP addresses do AlienGate scans come from?
AlienGate's vulnerability scans come from a fixed set of 125 IP addresses. Allow them on your firewall or WAF before you scan, or the results will be incomplete.

Which IP addresses do AlienGate scans come from?
AlienGate's vulnerability scans come from a fixed set of 125 IP addresses. Allow them on your firewall or WAF before you scan, or the results will be incomplete.
View full article

Dark Web
What Is Dark Web Monitoring? How to Find Leaked Data Before Attackers Use It
Dark web monitoring finds your leaked credentials and sensitive data before attackers use them. Here is how it works, what risks it detects, where its limits lie, and how to build it into operations.
View full article

Ransomware
What Is Ransomware-as-a-Service? Defending Your Business When Ransomware Is for Sale
Ransomware-as-a-Service (RaaS) lets criminals rent ransomware instead of building it. We explain how the RaaS division of labor works, why it matters, and how companies can defend themselves.
View full article

Ransomware
What Is AI-Driven "Ransomware 3.0"? The 2026 Threat Signaled by PromptLock
PromptLock showed how ransomware could use an LLM to generate parts of an attack on the fly. We explain what AI-driven "Ransomware 3.0" changes and which defenses businesses should revisit in 2026.
View full article

Ransomware
AI-Driven Ransomware: What Changes in 2026 and How Companies Should Prepare
When attackers use AI, ransomware becomes faster, more convincing and more personalized. We explain how AI-driven ransomware works and which security fundamentals companies should revisit in 2026.
View full article

Ransomware
What Is AI-Assisted Ransomware? How It Differs from Traditional Attacks and What to Rethink
Attackers are using AI to streamline ransomware preparation, phishing, data analysis and extortion. Here is how AI-assisted ransomware differs from traditional attacks, and seven defenses to rethink.
View full article

Dark Web
McAfee "Found on the Dark Web" Alert: Real or Fake? How to Tell in 30 Seconds and What to Do
A McAfee alert saying your data was found on the dark web can be genuine or a fake built to scare you. Here is how to tell which in 30 seconds, and exactly what to do in each case.
View full article

Dark Web
What Is the Dark Web? A Plain-English Guide, from Checking for Leaked Data to Protecting Your Company
What the dark web is, how it differs from the deep web, whether accessing it is illegal, what is traded there, and how individuals and companies can check for leaks and respond.
View full article
![How to Check Whether Your Data Is on the Dark Web: Four Free Tools and What to Do If You've Been Leaked [2026]](/images/blog/how-to-check-dark-web-leaks/cover.en.webp)
Dark Web
How to Check Whether Your Data Is on the Dark Web: Four Free Tools and What to Do If You've Been Leaked [2026]
Google's dark web report is gone. Here are four tools you can start using for free, what to do first if your data has leaked, and how to tell a genuine dark web alert from a phishing email.
View full article

Ransomware
After a Ransomware Attack: What Happens to Leaked Data on the Dark Web
Data stolen in a ransomware attack does not disappear when you refuse to pay. Here is how it is published, resold and abused on the dark web, and why the damage outlasts recovery.
View full article

Ransomware
Ransomware Powered by Generative AI: Where Companies Should Refocus Their Defenses from 2025
Generative AI has made ransomware faster and more precise, not fundamentally different. We look at the 2024–2025 trends, the groups to watch and why zero trust is about stopping the spread.
View full article

Dark Web
Who Was Alpha02? How the AlphaBay Takedown Changed Dark Web Enforcement
One careless welcome email unmasked Alpha02, the operator of AlphaBay. We look at how the largest dark web market fell, the Hansa trap that followed, and what it teaches defenders.
View full article

Ransomware
Identity Cloning: The Hidden Crime Behind Ransomware
Identity cloning copies a real person's identity so criminals can pass as them. Beyond fraud, it quietly supplies the phones, accounts and cover that ransomware operations rely on.
View full article

Ransomware
VPNs Are a Leading Ransomware Entry Point: What Japan's Police Data Shows and 7 Steps to Take Now
National Police Agency data shows VPN and RDP are the main routes into Japanese ransomware victims. Why VPNs are targeted, real cases from Handa Hospital to KADOKAWA, and seven defenses to start now.
View full article

Ransomware
Best Ransomware Protection Software Compared (2026): A Guide for Individuals and Businesses
How to choose ransomware protection software, with recommended products for individuals, small businesses and mid-sized companies, and whether free tools or Windows Defender alone are enough.
View full article

Ransomware
Behind Ransomware Attacks: Which Vulnerabilities Let Attackers In?
Most ransomware gets in not through exotic zero-days but through exposed RDP and known flaws left unpatched. We walk through five vulnerabilities used for initial access and why they get overlooked.
View full article

Ransomware
How to Recover from a Ransomware Attack (2026): Costs, Timelines and Success Rates
Can you really get your data back after ransomware? We look at real recovery rates, cost and timeline benchmarks, the first five response steps, and the five recovery options companies actually use.
View full article

Ransomware
Hit by Ransomware? What to Do Right Now, from First Response to Recovery for Businesses and Individuals
If ransomware hits, do three things first: cut the network, don't restart, and don't pay. Here is the full response, from first minutes to recovery, for both businesses and individuals.
View full article

Ransomware
What Is Ransomware? Infection Routes, Real-World Cases and Defenses Explained (2026 Update)
A plain-language guide to ransomware: how it works, the three main types, why VPNs are now the top entry point, recent Japanese cases, five defenses to start today and a five-step incident response.
View full article

Ransomware
The 6 Ransomware Infection Routes Explained: Latest Statistics and Countermeasures You Can Take Today (2026 Edition)
VPN devices account for 62% of ransomware intrusions and remote desktop for 22%, according to Japan's NPA. We break down the six main infection routes and the countermeasures to prioritize.
View full article

Ransomware
Types of Ransomware (2026): A Complete List of 16 Major Strains, Classified by Attack Method
The five types of ransomware by attack method, 16 major strains with their file extensions, how to identify a strain and find a decryptor, and the defenses and first-response steps to prioritize now.
View full article

Ransomware
7 Ransomware Attacks on Japanese Hospitals (2026 Update): Causes, Defenses and Recovery Costs
Seven ransomware attacks on Japanese hospitals, from Handa Hospital to Osaka General Medical Center: how attackers got in, what recovery cost and which defenses to prioritize.
View full article

Ransomware
15 Ransomware Attacks in Japan (2026 Update): What KADOKAWA, Toyota and Hospitals Teach Us About Defense
From KADOKAWA and Toyota to hospitals and outsourcing firms, we review 15 ransomware incidents, the industries and entry points attackers favor, and the countermeasures to prioritize now.
View full article

Dark Web
Russian Market: What a Dark Web Marketplace Reveals About How Data Leaks Today
Some dark web markets flare up and vanish; others quietly keep growing. Russian Market is the latter, a hub where stealer logs and credentials are sorted, filtered and sold as ready-to-use material.
View full article

Dark Web
What Do Dark Web Monitoring Companies Actually Look At? The 2026 Reality Japanese Businesses Need to Check
What do dark web monitoring companies actually watch, and how do they differ? We compare the main providers used in Japan and explain how to choose one that fits what you need to know.
View full article

Ransomware
The Work of Ransomware Negotiation: Taking Back Control in the Middle of Chaos
Ransomware negotiation is not about giving in. It is how you regain control of time, information and decisions. Drawing on field experience, we cover the first reply, sample decryption and more.
View full article

Dark Web
Understanding the Deep Web and the Darknet: A Practitioner's Guide to Approaching Them Safely
Most of the internet never appears in search results. We explain how the deep web differs from the darknet, who uses them, and how to approach them safely with Tor, VPNs and isolated VMs.
View full article

Dark Web
The Archetyp Market Takedown: Why One of the Dark Web's Largest Drug Markets Fell
In June 2025, Operation Deep Sentinel shut down Archetyp Market, a drug-only dark web market that ran for more than five years. Here is why it mattered and what happens next.
View full article

Dark Web
Inside the Dark Web: A Clear-Eyed Look at the Internet's Hidden World
A fact-based guide to how the dark web works, common myths and how criminals operate there, plus how to detect exposure, choose monitoring tools and respond when your data leaks.
View full article

Dark Web
Top 10 Dark Web Telegram Groups and Channels, and What They Really Do
Telegram has become a hub for dark web activity: stealer logs, leaked data, DDoS campaigns and hacking services. We profile ten notable channels and groups and explain how they operate.
View full article

Dark Web
Leaked Credentials on the Dark Web: What We Found and Why Japanese Companies Are Targeted
Our dark web investigation found thousands of leaked .co.jp email and password pairs in a credential dump on sale on a criminal forum. Here is what we found and what companies should do now.
View full article

Ransomware
WannaCry Ransomware (2017): The Cyberattack That Sounded a Global Alarm
In May 2017, WannaCry spread to more than 150 countries in a single day, halting hospitals and factories including Nissan and Hitachi in Japan. Here is how it worked and what it still teaches.
View full article

Dark Web
What Is Dark Web Monitoring? How to Find Leaked Data Before Attackers Use It
Dark web monitoring finds your leaked credentials and sensitive data before attackers use them. Here is how it works, what risks it detects, where its limits lie, and how to build it into operations.
View full article

Dark Web
McAfee "Found on the Dark Web" Alert: Real or Fake? How to Tell in 30 Seconds and What to Do
A McAfee alert saying your data was found on the dark web can be genuine or a fake built to scare you. Here is how to tell which in 30 seconds, and exactly what to do in each case.
View full article

Dark Web
What Is the Dark Web? A Plain-English Guide, from Checking for Leaked Data to Protecting Your Company
What the dark web is, how it differs from the deep web, whether accessing it is illegal, what is traded there, and how individuals and companies can check for leaks and respond.
View full article
![How to Check Whether Your Data Is on the Dark Web: Four Free Tools and What to Do If You've Been Leaked [2026]](/images/blog/how-to-check-dark-web-leaks/cover.en.webp)
Dark Web
How to Check Whether Your Data Is on the Dark Web: Four Free Tools and What to Do If You've Been Leaked [2026]
Google's dark web report is gone. Here are four tools you can start using for free, what to do first if your data has leaked, and how to tell a genuine dark web alert from a phishing email.
View full article

Dark Web
Who Was Alpha02? How the AlphaBay Takedown Changed Dark Web Enforcement
One careless welcome email unmasked Alpha02, the operator of AlphaBay. We look at how the largest dark web market fell, the Hansa trap that followed, and what it teaches defenders.
View full article

Dark Web
Russian Market: What a Dark Web Marketplace Reveals About How Data Leaks Today
Some dark web markets flare up and vanish; others quietly keep growing. Russian Market is the latter, a hub where stealer logs and credentials are sorted, filtered and sold as ready-to-use material.
View full article

Dark Web
What Do Dark Web Monitoring Companies Actually Look At? The 2026 Reality Japanese Businesses Need to Check
What do dark web monitoring companies actually watch, and how do they differ? We compare the main providers used in Japan and explain how to choose one that fits what you need to know.
View full article

Dark Web
Understanding the Deep Web and the Darknet: A Practitioner's Guide to Approaching Them Safely
Most of the internet never appears in search results. We explain how the deep web differs from the darknet, who uses them, and how to approach them safely with Tor, VPNs and isolated VMs.
View full article

Dark Web
The Archetyp Market Takedown: Why One of the Dark Web's Largest Drug Markets Fell
In June 2025, Operation Deep Sentinel shut down Archetyp Market, a drug-only dark web market that ran for more than five years. Here is why it mattered and what happens next.
View full article

Dark Web
Inside the Dark Web: A Clear-Eyed Look at the Internet's Hidden World
A fact-based guide to how the dark web works, common myths and how criminals operate there, plus how to detect exposure, choose monitoring tools and respond when your data leaks.
View full article

Dark Web
Top 10 Dark Web Telegram Groups and Channels, and What They Really Do
Telegram has become a hub for dark web activity: stealer logs, leaked data, DDoS campaigns and hacking services. We profile ten notable channels and groups and explain how they operate.
View full article

Dark Web
Leaked Credentials on the Dark Web: What We Found and Why Japanese Companies Are Targeted
Our dark web investigation found thousands of leaked .co.jp email and password pairs in a credential dump on sale on a criminal forum. Here is what we found and what companies should do now.
View full article

Ransomware
What Is Ransomware-as-a-Service? Defending Your Business When Ransomware Is for Sale
Ransomware-as-a-Service (RaaS) lets criminals rent ransomware instead of building it. We explain how the RaaS division of labor works, why it matters, and how companies can defend themselves.
View full article

Ransomware
What Is AI-Driven "Ransomware 3.0"? The 2026 Threat Signaled by PromptLock
PromptLock showed how ransomware could use an LLM to generate parts of an attack on the fly. We explain what AI-driven "Ransomware 3.0" changes and which defenses businesses should revisit in 2026.
View full article

Ransomware
AI-Driven Ransomware: What Changes in 2026 and How Companies Should Prepare
When attackers use AI, ransomware becomes faster, more convincing and more personalized. We explain how AI-driven ransomware works and which security fundamentals companies should revisit in 2026.
View full article

Ransomware
What Is AI-Assisted Ransomware? How It Differs from Traditional Attacks and What to Rethink
Attackers are using AI to streamline ransomware preparation, phishing, data analysis and extortion. Here is how AI-assisted ransomware differs from traditional attacks, and seven defenses to rethink.
View full article

Ransomware
After a Ransomware Attack: What Happens to Leaked Data on the Dark Web
Data stolen in a ransomware attack does not disappear when you refuse to pay. Here is how it is published, resold and abused on the dark web, and why the damage outlasts recovery.
View full article

Ransomware
Ransomware Powered by Generative AI: Where Companies Should Refocus Their Defenses from 2025
Generative AI has made ransomware faster and more precise, not fundamentally different. We look at the 2024–2025 trends, the groups to watch and why zero trust is about stopping the spread.
View full article

Ransomware
Identity Cloning: The Hidden Crime Behind Ransomware
Identity cloning copies a real person's identity so criminals can pass as them. Beyond fraud, it quietly supplies the phones, accounts and cover that ransomware operations rely on.
View full article

Ransomware
VPNs Are a Leading Ransomware Entry Point: What Japan's Police Data Shows and 7 Steps to Take Now
National Police Agency data shows VPN and RDP are the main routes into Japanese ransomware victims. Why VPNs are targeted, real cases from Handa Hospital to KADOKAWA, and seven defenses to start now.
View full article

Ransomware
Best Ransomware Protection Software Compared (2026): A Guide for Individuals and Businesses
How to choose ransomware protection software, with recommended products for individuals, small businesses and mid-sized companies, and whether free tools or Windows Defender alone are enough.
View full article

Ransomware
Behind Ransomware Attacks: Which Vulnerabilities Let Attackers In?
Most ransomware gets in not through exotic zero-days but through exposed RDP and known flaws left unpatched. We walk through five vulnerabilities used for initial access and why they get overlooked.
View full article

Ransomware
How to Recover from a Ransomware Attack (2026): Costs, Timelines and Success Rates
Can you really get your data back after ransomware? We look at real recovery rates, cost and timeline benchmarks, the first five response steps, and the five recovery options companies actually use.
View full article

Ransomware
Hit by Ransomware? What to Do Right Now, from First Response to Recovery for Businesses and Individuals
If ransomware hits, do three things first: cut the network, don't restart, and don't pay. Here is the full response, from first minutes to recovery, for both businesses and individuals.
View full article

Ransomware
What Is Ransomware? Infection Routes, Real-World Cases and Defenses Explained (2026 Update)
A plain-language guide to ransomware: how it works, the three main types, why VPNs are now the top entry point, recent Japanese cases, five defenses to start today and a five-step incident response.
View full article

Ransomware
The 6 Ransomware Infection Routes Explained: Latest Statistics and Countermeasures You Can Take Today (2026 Edition)
VPN devices account for 62% of ransomware intrusions and remote desktop for 22%, according to Japan's NPA. We break down the six main infection routes and the countermeasures to prioritize.
View full article

Ransomware
Types of Ransomware (2026): A Complete List of 16 Major Strains, Classified by Attack Method
The five types of ransomware by attack method, 16 major strains with their file extensions, how to identify a strain and find a decryptor, and the defenses and first-response steps to prioritize now.
View full article

Ransomware
7 Ransomware Attacks on Japanese Hospitals (2026 Update): Causes, Defenses and Recovery Costs
Seven ransomware attacks on Japanese hospitals, from Handa Hospital to Osaka General Medical Center: how attackers got in, what recovery cost and which defenses to prioritize.
View full article

Ransomware
15 Ransomware Attacks in Japan (2026 Update): What KADOKAWA, Toyota and Hospitals Teach Us About Defense
From KADOKAWA and Toyota to hospitals and outsourcing firms, we review 15 ransomware incidents, the industries and entry points attackers favor, and the countermeasures to prioritize now.
View full article

Ransomware
The Work of Ransomware Negotiation: Taking Back Control in the Middle of Chaos
Ransomware negotiation is not about giving in. It is how you regain control of time, information and decisions. Drawing on field experience, we cover the first reply, sample decryption and more.
View full article

Ransomware
WannaCry Ransomware (2017): The Cyberattack That Sounded a Global Alarm
In May 2017, WannaCry spread to more than 150 countries in a single day, halting hospitals and factories including Nissan and Hitachi in Japan. Here is how it worked and what it still teaches.
View full article
Find out what's already out there. It takes about forty seconds.
Run a free exposure check on your domain. If it comes back clean, you've lost a minute. If it doesn't, you've found out before someone else did.