Darkwatch watches ransomware leak sites, onion services, infostealer logs, breach and paste data, and public Telegram channels for the people and companies you're authorised to protect — scores every hit, remembers what it already told you, and says what to do about it. It only reads, and it runs on your own machine.
irm https://raw.githubusercontent.com/Daemon-VI/darkwatch/main/install.ps1 | iex
List the identifiers you want protected — names, emails, phone numbers, domains, usernames. Darkwatch checks them everywhere below, de-duplicates in a local database, and writes a report with an action for every finding.
Run scans, search stored findings, or investigate a one-off value across the live sources. A daily scheduled scan alerts you to anything new by desktop toast or phone push.
Keyword search, charts, triage in place, live scans over server-sent events. Loopback-only with a per-session token — it shows your data and never leaves your machine.
A findings tree by severity, scans and search from the command palette, triage from a finding's menu. On the Marketplace and Open VSX.
Everything is read-only and matched locally against your watchlist. A deep scan widens the reach further — every Telegram channel, more onion pages, links followed into matching sites.
Darkwatch is a defensive tool. The lines below are enforced in code, not just documented.
It never logs in, joins, posts, buys, or downloads files. Onion pages are fetched as text; it keeps a URL, a title, times and a short snippet — never a copy of a leak site.
Onion discovery goes through Ahmia's abuse filter, and links are followed only out of pages that already mention a watched identifier — so it never wanders an unfiltered index.
Account-walled forums and markets are out of scope on purpose: there is no read-only way in, and creating accounts is not what a monitor should do.
The watchlist and findings live on your machine. The dashboard binds to localhost with a token; phone pushes are redacted to counts. Monitor only identifiers you own or are authorised to.
The installer sets up uv if you don't have it, installs the latest release as the darkwatch command, and adds the VS Code extension when code is on your PATH.
irm https://raw.githubusercontent.com/Daemon-VI/darkwatch/main/install.ps1 | iexcurl -LsSf https://raw.githubusercontent.com/Daemon-VI/darkwatch/main/install.sh | shdocker run --rm ghcr.io/daemon-vi/darkwatch --helpImage on the GitHub Container Registry.
Then darkwatch setup → darkwatch run → darkwatch web. Full documentation is in the README.