How we work

Aswar is threat intelligence for the Arab world. This page explains where our information comes from, how we decide what to publish, and the lines we do not cross.

How an incident gets published

1. Collect. News outlets in Arabic and English, national CERT advisories, ransomware leak-site trackers, public Telegram channels and dark-web pages are collected automatically. News items and posts from attacker channels start as drafts that no customer sees. Ransomware leak-site listings are shown only as counts or as "Claimed by the attacker", never as confirmed incidents.
2. Group. Items about the same incident are joined into one story.
3. Verify. A story is published only when two independent outlets report it, or one primary source does: a national CERT, a regulator, the affected organisation itself, or a recognised security researcher. A post by an attacker never counts as confirmation.
4. Rewrite. Every published story is written in our own words, in Arabic and in English: what happened, who is affected, what is confirmed, what is only claimed, and what to do. We do not copy articles.
5. Label. Each story carries one label and lists its sources.

Confirmed and Claimed

Confirmed The core fact is reported by independent outlets or a primary source.

Claimed by the attacker The core fact rests on the attacker's word (for example a ransomware group listing a victim), even if outlets repeated it. "A group says it stole data" is not the same as "data was stolen".

What we never publish

• Personal data: names of private individuals, e-mail addresses, usernames, phone numbers, passwords, IP addresses or details of anyone's device.
• Stolen files, samples from leaks, or screenshots of leak posts or infostealer logs.
• Attribution in a headline that no evidence supports.

The free domain check

For any domain, the check shows counts only: the organisation's security rating, leaked credentials of that domain by kind (including infostealer logs), open internet exposures by category, and published incidents. It never shows who is affected or any credential. The organisation itself can verify its domain to see full details and receive alerts. The check is rate limited, and listing many domains automatically is not allowed.

Security ratings (A to F)

About 400 critical organisations in 13 countries are rated every day from public, passive evidence only: e-mail anti-spoofing records (SPF, DMARC), HTTPS and certificate quality, software past its end of life, services exposed to the internet, and incidents. We do not attack or scan intrusively. An organisation can dispute a finding with proof; accepted disputes remove the finding.

Where the data comes from

• National CERT advisories, CISA's catalogue of exploited vulnerabilities and the NVD.
• Ransomware leak-site trackers (ransomware.live, RansomLook).
• Arabic and English news outlets.
• Public Telegram channels, read through Telegram's public web preview without an account.
• Dark-web pages, read passively through Tor. We never log in, buy, download leaks or contact attackers.
• Certificate transparency logs and internet-scan data.

Leaked credentials

Leaked credentials are kept only when they belong to a covered country or a customer. Passwords are masked. Identities are shown only to named administrators or analysts of the organisation that owns the domain.

Corrections and removal

If something we published is wrong, or concerns you and should not be public, write to corrections@aswarcyber.com with the page address and what is wrong. We review every request, and we correct or withdraw a story that is wrong.

Reporting a security problem

Write to security@aswarcyber.com. Our security.txt has the details.