Mulberry · Trending Sources
A living view of which data sources open-source intelligence teams are using, from mainstream social platforms and news to dark web infrastructure and government records. Updated as the market shifts.
New maps each quarter. Nothing else.
Adversary-platform demand rising
2025 to 2026
Geopolitical demand keeps pulling open-source intelligence toward regional and adversary-nation platforms. VKontakte and Telegram stay central to Eastern-Europe and active-conflict monitoring, and buyer interest in them is rising, not flat.
Read More: fivecast.com
Open social web widening
May to June 2026
The open social web is widening the surface investigators have to map. Bluesky opened up long-form articles through the AT Protocol, and Mastodon added newsletters in version 4.6, both extending federated, self-hosted infrastructure well beyond short posts.
Read More: techcrunch.com, techcrunch.com
User-defined algorithm growth
July 2026
Platforms are handing feed control back to users. X retuned ranking to favor mutual connections, and Threads and Instagram shipped user-facing algorithm controls. Public feeds are increasingly personalized, so a single feed sample reads less as a representative view of the platform.
Read More: techcrunch.com, techcrunch.com
Reddit access closing
2026
Reddit is closing its open, machine-readable access. It moved to shut down the unauthenticated endpoints that allowed scraping for years, and as of mid-2026 old Reddit requires a login. Free anonymous collection is ending, and compliant, licensed access is becoming the only dependable path to Reddit data, which matters for any investigation that leans on Reddit as a primary source.
Read More: reclaimthenet.org
| IntegratedActive features of platforms | |||
| Source | Buyer Expectation | Demand Trend | Providers |
|---|---|---|---|
| X | High | Stable | 18 |
| 4chan | Medium | Stable | 1 |
| Medium | Stable | 2 | |
| Dark Web (TOR) | High | Growing | 4 |
| Pastebin | Medium | Declining | 2 |
| I2P Networks | High | Growing | 2 |
| 8kun | Medium | Declining | 1 |
| BitChute | Medium | Declining | 0 |
GrowingStableDecliningProviders = tracked provider count in Sourced. | |||
| ImplementingAdding or planned additions | |||
| Source | Buyer Expectation | Demand Trend | Providers |
| Telegram Hundreds of Telegram channels are monitored for stolen financial data alone, with standing access to extortion and hacktivist coordination channels, evidence of a platform that has become the default distribution layer for ransomware leak sites. | High | Growing | 6 |
| Discord Discord sits among the chat services monitored for threat actor community activity, and shared server admin patterns are used to trace coordinated repost networks, making it a working intelligence surface rather than a fringe messaging app. | Medium | Growing | 2 |
| GitHub Technical collection treats code repositories as a first-class source, watching for exposed credentials and API keys the moment they're committed. | High | Growing | 3 |
| GitLab Continuous crawls of GitLab run alongside GitHub to catch inadvertent source exposures and vulnerable public forks that never make it into GitHub's larger, more heavily monitored index. | High | Growing | 0 |
| Reddit Reddit is flagged for suspicious activity and threat detection, and brand abuse is tracked there directly, making it a crowd-sourced early-warning layer for both fraud and outage chatter. | High | Growing | 15 |
| VKontakte VK sits among the advanced social threat detection platforms, and it appears in public datasets built for war-crimes investigations, underscoring its role for Russian-language threat actor profiling. | Low | Growing | 5 |
| HackerNews Engineering-thread analysis on HackerNews surfaces architectural bugs and supply-chain criticism early, often before a vulnerability gets a CVE number. | Medium | Stable | 0 |
| StackOverflow Accidental code submissions on StackOverflow routinely expose live database credentials and cloud configuration values, which is why continuous scraping of the platform remains standard practice. | High | Growing | 0 |
GrowingStableDecliningProviders = tracked provider count in Sourced. | |||
| InterestExploring and planning | |||
| Source | Buyer Expectation | Demand Trend | Providers |
| Bluesky Federation metadata extraction maps community boundaries and infrastructure, maintained as an active, searchable dataset for investigations. That's a distinct trend from the platform's consumer-side numbers: security researchers and technical analysts are migrating in, even as general listening demand elsewhere softens. | Low | Stable | 7 |
| Signal Signal shows up in that same social engineering workflow, though the protocol's encryption limits collection to discovery metadata rather than message content. | Medium | Growing | 0 |
| Mastodon Federation metadata mapping isn't unique to Bluesky. The same technique applies to Mastodon, and active Fediverse datasets run today, real ongoing technical utility, evidence against last quarter's declining-relevance read. | Low | Stable | 0 |
| Bitbucket‡ Secret-scanning pipelines apply the same logic to Bitbucket that they apply to GitHub and GitLab, watching public developer workspaces for exposed credentials. | Medium | Stable | 0 |
| Gitee‡ Gitee's regional dominance in China makes it a distinct surface for tracking script variations and localized malware forks that rarely surface on Western-hosted repositories. | Medium | Growing | 0 |
| WeChat‡ Public security accounts on WeChat post vulnerability declarations and patch updates that don't reliably appear anywhere else, making it a primary channel for Chinese-language threat disclosure. | Medium | Growing | 1 |
| Sina Weibo‡ Weibo functions as a regional early-warning layer, surfacing exploit reports and infrastructure chatter across Asian network hubs before they're picked up elsewhere. | Medium | Growing | 1 |
| Rumble Structured API access to Rumble runs alongside 8kun and BitChute, treating alternative video platforms as a standing dataset for tracking extremist recruitment content and coordinated information campaigns. | Medium | Stable | 2 |
GrowingStableDecliningProviders = tracked provider count in Sourced. | |||
‡ Reflects Sourced's direct market assessment.
Who maintains this
This map is maintained by Mulberry, independent advisory for teams that build on social and web data. It is built from provider relationships and live evaluations across 50+ providers and 440+ data sources, not from vendor claims. Tyler Logtenberg has spent over a decade on the buyer side of this market and still builds on this data today.
Sourcing against one of these? We map your requirements, run them against the provider market, and test the shortlist before you commit budget to it.
Testing a provider yourself? KeyKit runs a structured evaluation on your own trial key, and the free query converter will move your existing queries across provider dialects.