Drael's site, read closely: hacker branding, thin product

Drael markets itself with hacker vocabulary: exploits, the dark web, "the OSINT nobody else will run". We read the site and the documentation page by page. What we found is a product with missing pages, placeholder text, claims its own documentation contradicts and almost nothing a security professional would ask for. In our opinion it is a costume.

Data collected on 9 and 10 November 2026 from Drael's site, its tools documentation, terms and llms.txt, and from NotHoly pricing. Each defect below can be checked by opening the address given. We did not sign in, so the app behind the login is not covered.

#What the copy says

The headline is "Nothing It Won't Answer". The tagline reads "Chat, code it writes and runs, images with nothing blurred, and the OSINT nobody else will run." The code section promises "the scanner, the exploit, the fix nothing else will", and the search section covers "the clear web and Tor hidden services alike". The three figures under the hero are zero answers refused, a day as the cheapest plan, and no personal data.

Nothing on the page mentions a scope, a client, a report, a methodology or a team. As we read it, the words are borrowed from offensive security and the offer is addressed to someone who wants to feel unrestricted.

#What the site looks like up close

What we found	Where
No pricing page. The nav link is an anchor, and the terms send you to "the plan page"	drael.sh/pricing returns 404
The cheapest plan, the day pass, is advertised three times with no price	Home page; absent from the plans endpoint
The public "Help" link redirects to sign-in	drael.sh/help
No channel to report a vulnerability	/.well-known/security.txt returns 404
Code samples call https://YOUR-HOST/v1 on a hosted service	Quickstart and images docs
Home page in nine languages; legal pages in two; docs in one	Sitemap; /es/legal/terms returns 404
The 404 page shows a Portuguese menu around an English message	Any missing page, Portuguese interface
English docs with comma decimals and dot thousands: "0,16", "13.218 tokens"	Limits and tools docs
Docs cite internal source files	"ledger/domain/published_test.go" in the limits page
Status page with no incident history, only a counter "since the server last started"	drael.sh/status

The Portuguese home page has sentences that read as word-for-word translations of English idioms. "Nada fora da mesa" stands for "Nothing off the table". "Nossas, e alcançam a rede" stands for "Ours, and they reach the net". A Portuguese speaker would write neither.

The documentation narrates its own history where a customer expects a description of the product: "That split did not earn its complexity and was removed", "There was, and it was removed", "What rations the scarce KV is the tier itself". The robots.txt carries notes to nobody in particular ("AI crawlers, stated honestly rather than performatively") and contradicts itself, blocking GPTBot and ClaudeBot in one block and allowing them /docs in another. The Portuguese sign-in screen accepts a code "do Drael antigo", from the old Drael, and the tools page refers to "the previous product".

We cannot know how this site was produced. What these defects suggest to us is text and pages generated quickly and published without a person reading them from start to finish.

#Where the copy and the docs disagree

The site says	The documentation says
Hero figure: zero answers refused	provider_refused: "The image model refused this prompt"
"the OSINT nobody else will run"	"they are not what the product leads with"
"There is no AI vendor in the path"	"generate_image is cash at a provider per attempt"
"nothing you ask goes to a third party's API"	The breach lookup "sends the identifier you asked about to the lookup service"
"Priced by the month"	A month is four weeks
"the exploit, the fix"	"Nothing Drael says is legal, medical, financial or security advice"

There may be an explanation for each row. A buyer should not have to reconcile a landing page with its own error reference.

#The breach lookup is the legal problem

The OSINT feature is one tool, breach_lookup: "An email, a username, a phone, a domain, a password. It says where an identifier has already leaked." Those are other people's personal data. Under the LGPD and the GDPR, looking them up needs a lawful basis, and on a client job it needs to be in the scope.

Drael's pages offer neither a basis nor a contract. The identifier goes "to the lookup service and the databases it consults", which the privacy page does not name. The terms forbid using Drael to "stalk, threaten or expose a private person" and then leave the judgment and the liability with you. Our reading of the terms covers the indemnity.

#What the work looks like under contract

Real OSINT on an engagement starts from a written scope, as PTES and NIST SP 800-115 describe, and ends in a report where each item has a source, a time and a handler. The IBM Cost of a Data Breach 2026 release puts the average breach at US$ 4.99 million, and Netskope counts 223 GenAI data policy violations per organization per month. Clients read those reports, and they ask where their data went.

NotHoly's dark web search lists results and never opens a .onion. read_url reads public pages only. Nothing on our servers scans or queries a target. That is less exciting than Drael's page, and it is what lets you put the tool in a statement of work.

#Where each fits

Drael's site sells the feeling of working unrestricted, and it fits someone who wants that feeling and an uncensored chatbot with image generation. NotHoly is built for paid security work: a scope the traffic respects, a model whose base you can cite, dark web search that only lists results, and read_url that reads public pages. That is less exciting than "the OSINT nobody else will run", and it is what you can put in a statement of work.

#Frequently asked questions

#Is AI OSINT legal?

It depends on the data and your basis for processing it. Public pages are one thing. Leaked credentials of named people are personal data, and you need a lawful basis and usually a scope.

#What is a breach lookup, and who sees the query?

A search of leaked databases for an identifier. On Drael the identifier is sent to a lookup service and databases the privacy page does not name.

#Is Drael a security tool?

It uses the vocabulary. We found no scope controls, no audit trail, no team features and no vulnerability reporting channel.

#What makes an AI tool fit for red team work?

Execution from your own addresses, a model you can name, logs you keep and a vendor in the contract. See red team.

#Does NotHoly do OSINT?

It helps with methodology, triage and reporting, reads public pages and lists dark web search results. It does not run breach lookups or touch targets.

#Verdict

Drael's site sells the feeling of being a hacker and delivers a chatbot with image generation, built on pages that point to addresses that do not exist. We do not think it was made for people who do this for a living, and nothing we read suggests it was tested by them. Why professionals do not run engagements on Drael has the checklist, and NotHoly pricing starts at US$ 5.