Lurk

What is Lurk

Lurk is a privacy-first open-source intelligence (OSINT) platform focused on breach data, IP intelligence, and threat monitoring. As of 2026-05-30, it operates at lurk.st and offers access to 15 billion+ breached credentials, live IP reputation data from GreyNoise and Shodan, darknet forum monitoring across 50+ sources, username cross-platform enumeration, and ransomware tracker feeds. The service explicitly targets cybersecurity professionals, penetration testers, red teams, independent security researchers, and journalists.

This represents a significant departure from the older source metadata, which characterized Lurk as a "non-custodial swap aggregator" for cryptocurrency. The current service has no apparent connection to that earlier description and functions entirely as an OSINT research tool.

How no-KYC is it?

Lurk implements a genuine no-KYC model with no identity verification at any tier. The architecture deliberately eliminates traditional account systems:

• No email addresses collected
• No names required
• No identity documents requested
• No phone verification
• Access granted solely through anonymous cryptographic tokens

The token system is explicitly modeled after privacy-preserving mechanisms used by Mullvad VPN. Upon payment, users receive a token displayed exactly once. Only a SHA-256 hash of that token is retained server-side for validation. Lost tokens cannot be recovered, and token holders cannot be identified. This design choice makes compelled user identification technically impossible by architecture rather than merely policy.

Privacy & security

Lurk's privacy architecture extends beyond the token system to network and application layers. According to the site's privacy policy (last updated May 2026):

• IP addresses are never logged
• Browser fingerprints are never collected
• Search queries run in memory and are not written to disk
• Traffic routes through a privacy-configured edge network with logging disabled
• No analytical, behavioral, marketing, or tracking cookies
• No third-party scripts execute on the platform
• One first-party session cookie retains only the hashed token during active sessions

The platform publishes a monthly PGP-signed warrant canary, with the most recent dated 2026-05-25. The canary states that Lurk has not received national security letters, gag orders, court orders compelling disclosure, or government demands to modify the platform for surveillance. The next update is due 2026-06-20.

Payment processing occurs through third-party cryptocurrency processors, with the site noting that Monero transactions provide additional privacy through stealth addresses and ring signatures by default.

Payments, fees & limits

Lurk offers three pricing tiers, though specific fee amounts are not disclosed in the crawled pages. The structure includes:

• Free tier: 5 searches per day
• Paid tiers: Pro access with expanded query limits (specific search allowances not enumerated in available evidence)

Accepted cryptocurrencies include BTC, ETH, XMR, and USDT. The payment flow involves selecting a plan, choosing a currency, confirming payment, sending the transaction, and receiving the access token. The site emphasizes "no upsells" in its tier description.

No refund policy applies, per the terms of service. Payment records contain only a transaction ID and plan tier, with no IP address, email, or physical identity processed during payment.

User experience & support

The platform operates without traditional user accounts, which fundamentally changes the support model. Users cannot reset passwords, recover access, or request account modifications. Token loss means permanent access forfeiture.

The interface appears streamlined around immediate search functionality with a live demo showing sample query results for IP intelligence and breach data. Export options include JSON format for results. System status monitoring shows all components operational as of the last update on 2026-05-29.

Contact options exist for domain opt-out requests and general inquiries via lurk.st/contact. The terms of service specify an opt-out mechanism for individuals wishing to exclude their email addresses from search results, which works by SHA-256 hashing the identifier and storing only that hash for exclusion purposes.

Who it's for

Lurk suits privacy-conscious security researchers, journalists investigating breaches, penetration testers, and red teams who need OSINT capabilities without creating identifiable accounts or leaving audit trails. The explicit prohibition against stalking, harassment, doxxing, credential stuffing, and unauthorized penetration testing indicates the service attempts to serve legitimate research use cases while disclaiming malicious applications.

The free tier's 5 searches per day allows casual evaluation, though serious research requires paid access. Users comfortable with irreversible token management and no recovery options will find the privacy trade-offs acceptable; those needing traditional account support structures will not.