01 / 12
Try it now
Search six indexes at once
Live engines and the archive side by side, with the pages no live index returns any more shown first.
- No account
Loading this page
101 modules, 322 graded collectors.
What each plan opens, what one collection looks like at each plan’s price, and how every source and finding is graded and can be checked.
The platform today
- 322 graded collectors
- 67 upstream endpoints probed on the status page
- 102 live modules
- 10 analytic layers
What the platform is
One record, from the first source to the final report.
Blackout Intelligence OS is the environment the firm's analysts work in, and the one clients use to run their own investigations. It comes after the intelligence services: the services are the work, and the platform is where that work is recorded, graded and checked.
- graded collectors across the platform
- 322
- modules a paid plan opens
- 101
- upstream endpoints probed on the public status page
- 67
How a finding is made
Every finding keeps its chain.
A conclusion is only as good as the record behind it. Each stage below leaves something a reviewer can open.
- 01
Collect
Graded collectors read approved sources. Each record keeps its source and the time it was collected.
- 02
Record
Event, publication and collection time are kept apart. Corrections and retractions are preserved, not overwritten.
- 03
Grade
Sources and findings are graded on the NATO Admiralty System, so confidence travels with the intelligence.
- 04
Corroborate
Competing accounts are set side by side. Unresolved gaps are listed, not filled in.
- 05
Review
An analyst accepts, rejects or returns each conclusion. The decision stays on the record.
- 06
Report
Reports are generated from the record, and export as STIX 2.1 or CSV for the systems a team already uses.
The grading scale and the review steps are set out in full on the evidence page.
Everything it does
Flick through the whole platform.
Swipe or use the arrows. The first four work right now with no account.
1 / 12
What the money buys
The same collection, at every price
One search on one subject, 12 findings. Change the plan and watch the document change. Nothing below is a mock-up of the paywall: the masking is performed by the same function that runs on the server for paying customers.
Findings in full
8
Beyond this, a finding keeps its title, severity and grade — the values are masked.
Field values per finding
10
How deep a single finding is allowed to go before the rest is withheld.
Hosts probed per estate scan
12
How much of an organisation's estate one scan actively reaches.
8 of 12 findings readable in full
7 field values masked
- B2
Action required
Mail-capable host with no DMARC policy
No DMARC record served at _dmarc
- Records observed
- 2 MX, 1 SPF, no DMARC TXT
- Effect
- Receivers have no published instruction for failing mail.
- Caveat
- A policy may exist on a parent zone. Confirm before acting.
Very likely (80–95%) · SPF and DMARC policy
Provenance
Collection report — 10 of 12 collectors answered
- Answered
- 10 of 12
- Did not answer
- Wayback Machine archive, GDELT news index
- C3
Review
Administrative interface exposed on 8080/tcp
- Port
- 8080/tcp
- Banner
- HTTP 200 · login form
- Transport
- Cleartext
- Address
- 198.51.100.24
- Caveat
- Point-in-time scan. Confirm directly before acting.
- First seen
- 2026-08-29
Likely (55–79%) · Shodan exposed services
- B2
Review
Sender Policy Framework — weak (?all)
- Result
- v=spf1 include:_spf.example ?all
- Assessment
- Neutral qualifier — unauthenticated senders are neither authorised nor rejected.
- Recommended
- ~all, then -all once senders are enumerated.
Likely (55–79%) · SPF and DMARC policy
- A1
Context
Registrant record
Registry of record
- Result
- Registration active
- Created
- 2019-03-07
- Updated
- 2026-06-02
- Expires
- 2027-03-07
- Registrar
- Specimen Registrar Ltd
- Registrar IANA ID
- 9999
- Status
- clientTransferProhibited
- Nameserver 1
- ns1.specimen-dns.example
- Nameserver 2
- ns2.specimen-dns.example
- DNSSEC
- unsigned
- Registrant organisation
- ••••••••••
- Abuse contact
- ••••••••••
Almost certain (96–100%) · RDAP registration
2 values withheld on Explorer
- A2
Clear
Sanctions screening — no match
- Result
- No exact or fuzzy match against the consolidated list.
- Lists
- OFAC SDN · UK HMT · EU consolidated
- Caveat
- Name-based screening. Aliases and transliterations can evade a match.
Very likely (80–95%) · OFAC SDN sanctions screening
- B2
Context
Certificate transparency — 14 names issued
- Result
- 14 distinct names across 6 certificates
- Most recent
- 2026-08-24
- Issuers
- Let's Encrypt · Sectigo
Very likely (80–95%) · Certificate transparency (crt.sh)
- A2
Context
Persons with significant control — 2 individuals
- Result
- 2 registered PSCs
- Nature of control
- Ownership of shares 25–50%
- Appointed
- 2025-11-19
Almost certain (96–100%) · Persons with significant control
- B2
Context
Co-hosted domains on the same address
- Result
- 41 other names resolve to this address
- Count
- ••••••••••
- Caveat
- Shared hosting. Co-residence is not association.
Likely (55–79%) · RIPEstat routing and abuse contact
1 value withheld on Explorer
- B2
Context
Routing origin and abuse contact
- Result
- Announced by a single origin AS
- Origin AS
- ••••••••••
- Abuse contact
- ••••••••••
Very likely (80–95%) · RIPEstat routing and abuse contact
2 values withheld on Explorer
- B2
Context
TLS certificate presented by the host
- Result
- Valid chain, matches the requested name
- Issuer
- ••••••••••
- Expires
- ••••••••••
Very likely (80–95%) · TLS certificate handshake
2 values withheld on Explorer
- B2
Review
DNSSEC unsigned — answers are unprotected against forgery
- Result
- No DS record at the parent zone
- Effect
- A resolver cannot tell an authentic answer from an injected one.
- Registrar support
- Available, not enabled
Very likely (80–95%) · DNS resolution
A critical finding is never withheld
Switch to Explorer and the mail-capable host stays fully readable. Masking a sanctions hit or an exploited service from someone about to transact would be harmful, and the upgrade is sold on breadth rather than on hiding danger.
Nor is the collection record
Which collectors answered, and which did not, is readable on every plan. It is the cheapest possible proof the search was real, and hiding it would undo the argument the rest of the product rests on.
7 data points withheld on this scan
Professional returns the full depth on every lookup — all findings, all fields, and 24 hosts per estate scan.
A second worked example, on a separate .example subject — RFC 2606 reserves the domain, so nobody can register it. The redaction is real; the subject is not.
How the platform grades what it knows
What the platform does, row by row.
Each row names one thing the platform does and where to check it today. Figures are counted from the code or measured on a stated date, and each row links to the place it can be seen.
- 21
- differences, itemised
- 322
- collectors, every one graded
- 67
- sources published and measured
- 102
- live modules, one workspace
8 of 21
The grade
How good is this finding, and who says so?
The source and the information are graded separately — a letter A–F for how reliable the source is, a digit 1–6 for how credible this particular item is.
Why it mattersA completely reliable source can report something improbable, and an unreliable one can report something confirmed elsewhere. Keeping the two grades apart is what shows a reader which of those they are looking at.
See a graded finding NATO Admiralty Code (STANAG 2511)99 grading rules, each with a written rationaleProbability is expressed in fixed language mapped to numeric bands, so "likely" means the same thing to the analyst who wrote it and the person acting on it.
Why it mattersAn enforcement decision taken on a word the two parties priced differently is a decision nobody can defend afterwards.
Read the ladder ICD 203, the US Intelligence Community directive on analytic standardsGrade A is reserved for the body that issues the fact — a sanctions authority for its own designations, a registry for its own registrations. Nothing earns it by being popular.
Why it mattersA copied fact is useful, but it is only as strong as the record it came from, and a report that does not name the issuing record cannot be audited.
See the register Authority for the specific claim — the governing principle of the source register92 of 322 collectors graded A, 147 B, 77 C, 6 DThe grading register is published with a written rationale per source, so a reviewer can argue with the grade rather than take it on trust.
Why it mattersA grade a reviewer can read the reasons for is one they can defend when the other side’s expert asks how it was reached.
Open the register A published source register with a written rationale per entry
The record
What was actually asked, and when?
Every source is recorded in one of five states: it answered, it answered and held nothing, it refused us, it did not respond, or it was not applicable.
Why it mattersA refusal recorded as an empty result reads as a clean negative. A 403 from a social network is a refusal, and says nothing about whether an account exists.
See a collection record Five recorded states: answered, empty, refused, no response, not applicable5 states, applied to every collector in every runEach source carries the moment it answered, not the moment the report was generated.
Why it matters"Companies House was unreachable at 14:03:11Z" can be checked against that provider’s own status page afterwards. "Unreachable" cannot.
Read the record ISO 8601 UTC stamped per collector as it reportsEvent time, publication time and collection time are held apart, and an unknown event time stays unknown rather than being filled in from the publication time.
Why it mattersCopying "reported this morning" into "happened this morning" is invisible, because every field ends up populated and nothing looks wrong.
See the world record Three separate clocks, with “unknown” a permitted value rather than a blankHistory is append-only. A correction keeps the earlier claim readable, and a retraction is a state carrying the withdrawn claim rather than a deletion.
Why it mattersA reader needs to know a thing was once asserted, especially when somebody acted on it before it was withdrawn.
Open the world engine Database-enforced: an update that rewrites a version already on record is refused
Every row links to the place it can be checked. If a row is wrong, tell us and it will be corrected.
See the evidence standardBefore you can file it
The three questions procurement asks.
01
Secure by design
Server-verified subscriptions, an AES-256 encrypted key vault and row-level data isolation. Access is never gated by client JavaScript.
02
Your queries stay yours
We do not sell, share or resell what you look up. Provider keys are yours, held encrypted, and billed to you — never pooled across customers.
03
Defensible by default
Every finding carries its source grade, its credibility rating and the record of which collectors answered. Export it and the reasoning travels with it.
Blackout OS / Two flagship environments
Explore the Workspace. Then the World View.
Two connected environments. Explore the world, then bring the relevant signals into an investigation you can inspect.
322
graded collectors across the platform
91
operational modules in the 6 areas below
6
areas of work, from command to developer tools
8
flagship modules, each open to sign-in
Investigation environment / 01
Blackout OS Workspace
Work with an interactive relationship canvas, source references, evidence boards and report drafts using a synthetic training investigation.
Try the interactive training demo Demo · fictional records
Global intelligence / 02
Blackout World View
Open the public globe and flat map. Inspect each source reading and follow its provenance.
Explore the Earth demo Public · source coverage
Preview the world feed on this page before you open it.
Areas of work
6 areas, one record underneath them.
Command and cases
42 modulesOperations, cases, briefings and the record of each decision.
Due diligence and sanctions
6 modulesCompanies, counterparties, suppliers and sanctions screening.
Cyber and digital threat
14 modulesAttack surface, vulnerabilities, DNS, certificates and attribution.
Geospatial and premises
3 modulesPremises, maps, live situational awareness and infrastructure footprint.
Developer and integrations
9 modulesAPIs, webhooks, exports and standard formats such as STIX.
Blackout applications
17 modulesStandalone applications that run inside the OS.
Flagship modules
The products we lead with.
- War RoomOne screen for your watchlist threats, DEFCON posture, live intelligence and worldwide operations.
- Priority RequirementsDeclare the geography, keywords and thresholds that matter. The live world is scored against them continuously.
- Live OperationsLive earthquakes, aircraft, wildfires, storms and volcanoes on one world map, streaming around the clock.
- Premises IntelligenceWhat is at a UK address: its location, Land Registry price-paid sales, recorded street crime and the neighbourhood policing team.
- Attack SurfaceThe internet-facing hosts, open ports, services and known CVEs an organisation exposes, scored into one exposure grade.
- Due Diligence PackStatutory registers, officers and corporate records for one company, in one document.
- Source ReliabilityGrade each source and finding on the NATO Admiralty System, so confidence travels with the intelligence.
- Evidence LockerChain-of-custody storage for artefacts, screenshots and exports.
What works in the app
Built for the work after the search.
- 01Records that keep their timesEvent, publication and collection time are kept apart. Every correction and retraction is preserved, and a new story is told apart from a changed one, and from the same story arriving again. World Engine
- 02Conclusions reviewed before they standAn analyst accepts or rejects each conclusion, or returns it for more work. The decision stays on the intelligence record. Evidence Review Queue
- 03External intelligence, imported with its markingsSTIX 2.x intelligence comes in with its relationships, markings and confidence, and can be filed into a case. Intelligence Exchange
- 04Alerts and exports where your team worksAlerts go to Slack, Discord or Microsoft Teams. Reports export as STIX 2.1 or CSV for your SIEM, MISP or OpenCTI. Integrations & Export
- 05One search across the whole recordCases, reports, evidence, sightings, graph entities and history in one search, without needing to know which module holds the subject. Universal Search
- 06Reports from the recordIntelligence reports generated from any investigation. Reports
- 07Your systems, connectedAPI keys and webhooks, so your own systems can query the intelligence. Developer API
- 08A record of what AI agents decidedA tamper-evident record of each decision an AI agent makes, so the reasoning can be reviewed later. AgentAudit
Browse the 5 specialist capabilitiesSecure account access
01
Command Centre
View cases, priorities, recent activity and operational status in one place.
Sign in to access02
Investigation Engine
Structure investigations around traceable findings, cases and evidence.
Sign in to access03
Watch the World
Explore geographic context and source-labelled global information.
Sign in to access04
Evidence Vault
Review provenance, records and the evidence trail supporting findings.
Sign in to access05
Collection Control
Manage permitted collections, source availability and operational hand-offs.
Sign in to accessWorkspace and specialist module access depend on your subscription and each source's availability. Intelligence Fusion is included from Professional+. The Workspace training demo uses fictional records; the public explorer never exposes private case records.
Compare access plansNo account, no card
Don't take our word for it. Run one.
Type a domain. This is the live collector behind the paid plans, querying sources now rather than replaying a recording.
Try
Domains only in the public preview. No personal data is searched here, deliberately.
Now check whether it can be defended.
A module list states what the platform can do. The evidence page shows whether each result can be defended: the report itself, how findings are graded, and what happens when a source refuses to answer.