Quick start

Paste everything you know in the big box: domains, emails, GitHub handles, org names, what you want checked (breaches, lookalikes). Umbra builds an IntentPlan. Nothing hits the network until you click Confirm & run.

brand example.com
GH octocat
[email protected]
check lookalikes and breaches

Authorization

Use this tool only for assets you own, client-authorized work, public CTI, or training on public data. Every case records an authorization basis for audit; the CLI lets you state it explicitly with -b.

own_asset — your brand, domains, accounts
client_engagement — contracted scope
public_cti — malware infra / public indicators
training_lab — learning on public examples

Google-style dorks (for the Intent box)

Umbra is not Google — but you can paste dork-like lines so the planner picks up identifiers and flags. Combine with real identifiers.

Site & domain

site:example.com
domain:example.com
inurl:admin example.com
lookalikes for example.com
typosquat watch example.com

Email & breach

email [email protected]
breach check [email protected]
hibp [email protected]
pwned / compromised credentials for [email protected]

Usernames & social

github:octocat
GH example-user
https://github.com/octocat
linkedin.com/in/someone
@handle
username probe everywhere octocat

Org / filings

company: Acme Robotics
org Acme LLC edgar filings
corp records Acme

Historical / web

wayback example.com
archive.org example.com
web search Acme Robotics Bentonville

Person (authorized)

person: Jane Doe
person Jane Doe Bentonville AR
umbra people lookup "Jane Doe"
umbra playbook person_footprint --person "Jane Doe" --location "Bentonville, AR"

Lake lookup (instant, stored obituary links): /people. County pack coverage: /people/coverage. Full investigation uses Search with person: Full Name.

Crypto address

0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
bc1q…
umbra crypto screen ADDRESS
umbra crypto labels sync

Offline OFAC/curated labels: /crypto. Labels are risk signals, not guilt.

Other entities the one-box accepts

domain · IP · email · URL · username (github:/linkedin:/…) · org · person · phone · MAC · crypto address. Phone: /phone and /reputation.

Example “dork pack” intents

# Brand defense
domain example.com
lookalikes typosquat brand abuse
[email protected] breach check

# Person footprint (authorized)
person Jane Doe
company Example Corp
github:janedoe
email [email protected]
location Bentonville AR

# Infra
8.8.8.8
example.com
wayback example.com

Flags the planner understands

Say something like…	Flag	Collectors
lookalike, typosquat, brand abuse	want_lookalikes	lookalike_domains
breach, pwned, hibp, leaked	want_breaches	hibp_breach
edgar, llc, corp records	want_corp_records	wikidata, edgar, opencorporates…
username everywhere, sherlock	aggressive_username_probe	username_presence
wayback, archive.org	want_wayback	wayback_cdx
google, web search	want_web_search	ddg_search

Advanced CLI

# Deterministic plan
umbra intent "example.com gh octocat breaches" -b own_asset

# LLM enrich (LocalAI / OpenAI-compatible)
export UMBRA_LLM_BASE_URL=http://127.0.0.1:8080/v1
export UMBRA_LLM_MODEL=your-model
umbra intent "messy notes…" -b client_engagement --llm

# Execute from CLI
umbra intent "…" -b own_asset --confirm

# After a case exists
umbra entities <case_id>
umbra score <case_id>
umbra profile <case_id>
umbra entity verify <entity_id> -s true
umbra watch add -t domain -v example.com -c <case_id>
umbra breach password
umbra breach email [email protected]

LLM planner

Optional. Deterministic extractors always run first; the model only merges extra structure. Set UMBRA_LLM_* env vars. UI dropdown: Auto / Deterministic / Force LLM.

Confidence & verify

After a run, entities get multi-factor scores (high / medium / low / speculative). Mark truth with umbra entity verify. Verification overrides scores.

Policy & ethics

Dark-web exposure monitoring is passive & defensive only. Only authorized assets. No purchasing, no participation, no re-hosting of stolen data.

No dark-web market scrapers. No silent doxxing chat. Breach data via HIBP. Findings are leads to check, not verified facts. Full framework: docs/ETHICS.md in the repo.

Docs in repo

docs/INTENT-SEARCH.md
docs/COLLECTORS.md
docs/SCORING.md
docs/DEPLOYMENT.md
docs/BREACH-AND-MONITORING.md