Monitoring Dark Web Sources
When to Use
Use this skill when:
- Establishing continuous monitoring for organizational domain names, executive names, and product brands on dark web forums
- Investigating a reported data breach claim found on a ransomware leak site or paste site
- Enriching an incident investigation with context about stolen credentials or planned attacks
Do not use this skill without proper operational security measures — dark web browsing without isolation exposes analyst infrastructure to adversary counter-intelligence.
Prerequisites
- Commercial dark web monitoring service (Recorded Future, Flashpoint, Intel 471, or Cybersixgill)
- Isolated operational environment: Whonix OS or Tails OS running in a VM with no persistent storage
- Keyword watchlist: organization domain, key executive names, product names, IP ranges, known credentials
- Legal guidance confirming passive monitoring is authorized in your jurisdiction
Workflow
Step 1: Establish Keyword Monitoring via Commercial Services
Configure dark web monitoring keywords in your CTI platform (e.g., Recorded Future Exposure module):
- Domain variations:
company.com, @company.com, company[dot]com
- Executive names: CEO, CISO, CFO full names
- Product/brand names
- Internal codenames or project names (if suspected breach scope is broad)
- Known email domains for credential monitoring
Most commercial services (Flashpoint, Intel 471, Cybersixgill) crawl forums like XSS, Exploit[.]in, BreachForums, and Russian-language cybercriminal communities without analyst exposure.
Step 2: Manual Investigation with Operational Security
For investigations requiring direct dark web access:
Environment setup:
- Use a dedicated physical machine or air-gapped VM (Whonix + VirtualBox)
- Connect via Tor Browser only — never via standard browser
- Use a cover identity with no links to organization
- Never log in with real credentials to any dark web site
- Document all sessions in investigation log with timestamps
Paste site monitoring (clearnet-accessible, no Tor required):
# Hunt paste sites via API
curl "https://psbdmp.ws/api/search/company.com" | jq '.data[].id'
curl "https://pastebin.com/search?q=company.com" # Rate-limited public search
Step 3: Investigate Ransomware Leak Sites
Ransomware groups maintain .onion leak sites. Monitor these through commercial services rather than direct access. When a claim appears about your organization:
- Capture screenshot evidence via commercial service (do not access directly)
- Assess legitimacy: Does the threat actor's claimed data align with any known internal systems?
- Check timestamp: Is this claim recent or historical?
- Cross-reference with any known security incidents or phishing campaigns from that timeframe
- Engage IR team if claim appears credible before public disclosure
Known active ransomware leak site operators (as of early 2025): LockBit (disrupted Feb 2024), ALPHV/BlackCat (disrupted Dec 2023), Cl0p, RansomHub, Play.
Step 4: Credential Exposure Monitoring
For leaked credential monitoring:
- Have I Been Pwned Enterprise: Domain-level notification for credential exposures in breach datasets
- SpyCloud: Commercial credential monitoring with anti-cracking and plaintext password recovery from criminal markets
- Flare Systems: Automated monitoring of paste sites and dark web markets for credential dumps
When credential exposures are confirmed:
- Force password reset for affected accounts immediately
- Check if credentials provide access to any organizational systems (SSO, VPN)
- Review access logs for the period between credential exposure and detection for unauthorized access
Step 5: Document and Escalate Findings
For each dark web finding:
- Capture evidence (commercial service screenshot, paste site archive)
- Classify severity: P1 (imminent attack threat or active data exposure), P2 (credential exposure), P3 (general mention)
- Notify appropriate stakeholders within defined SLAs
- Open investigation ticket and link to evidence artifacts
- Apply TLP:RED for any findings referencing named executives or specific attack plans
Key Concepts
| Term |
Definition |
| Dark Web |
Tor-accessible hidden services (.onion domains) not indexed by standard search engines; hosts both legitimate and criminal content |
| Paste Site |
Clearnet text-sharing sites (Pastebin, Ghostbin) frequently used to publish stolen data or malware configurations |
| Ransomware Leak Site |
.onion site operated by ransomware group to publish stolen victim data as extortion leverage |
| Operational Security (OPSEC) |
Protecting analyst identity and organizational affiliation during dark web investigation |
| Credential Stuffing |
Automated use of leaked username/password pairs against authentication systems |
| Stealer Logs |
Data packages exfiltrated by infostealer malware containing saved browser credentials, cookies, and session tokens |
Tools & Systems
- Recorded Future Dark Web Module: Automated monitoring of dark web sources with alerting on organization-specific keywords
- Flashpoint: Dark web forum monitoring with human intelligence augmentation for criminal community context
- Intel 471: Closed-source access to cybercriminal communities with structured intelligence on threat actors
- SpyCloud: Credential exposure monitoring with recaptured plaintext passwords from criminal markets
- Have I Been Pwned Enterprise: Domain-level breach notification API for credential monitoring at scale
Common Pitfalls
- Direct access without OPSEC: Accessing dark web forums without Tor and a cover identity can expose analyst IP, browser fingerprint, and organization affiliation to adversaries.
- Overreacting to unverified claims: Ransomware groups and forum posters fabricate attack claims for extortion or reputation. Verify before escalating to incident response.
- Missing clearnet sources: Most dark web intelligence programs miss Telegram channels, Discord servers, and paste sites which operate on the clearnet and host significant criminal activity.
- Inadequate legal review: Dark web monitoring must be reviewed by legal counsel — passive monitoring is generally lawful but active participation in criminal markets is not.
- No evidence preservation: Dark web content disappears rapidly. Capture timestamped evidence immediately upon discovery using commercial service exports.
1---2name: monitoring-darkweb-sources3description: Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide early warning intelligence. Use when establishing dark web monitoring coverage, investigating specific data breach claims, or enriching incident investigations with dark web context. Activates for requests involving dark web OSINT, leak site monitoring, credential exposure, Recorded Future dark web, or Tor hidden service intelligence.4license: Apache-2.05---6# Monitoring Dark Web Sources
7
8## When to Use
9
10Use this skill when:
11- Establishing continuous monitoring for organizational domain names, executive names, and product brands on dark web forums
12- Investigating a reported data breach claim found on a ransomware leak site or paste site
13- Enriching an incident investigation with context about stolen credentials or planned attacks
14
15**Do not use** this skill without proper operational security measures — dark web browsing without isolation exposes analyst infrastructure to adversary counter-intelligence.
16
17## Prerequisites
18
19- Commercial dark web monitoring service (Recorded Future, Flashpoint, Intel 471, or Cybersixgill)
20- Isolated operational environment: Whonix OS or Tails OS running in a VM with no persistent storage
21- Keyword watchlist: organization domain, key executive names, product names, IP ranges, known credentials
22- Legal guidance confirming passive monitoring is authorized in your jurisdiction
23
24## Workflow
25
26### Step 1: Establish Keyword Monitoring via Commercial Services
27
28Configure dark web monitoring keywords in your CTI platform (e.g., Recorded Future Exposure module):
29- Domain variations: `company.com`, `@company.com`, `company[dot]com`
30- Executive names: CEO, CISO, CFO full names
31- Product/brand names
32- Internal codenames or project names (if suspected breach scope is broad)
33- Known email domains for credential monitoring
34
35Most commercial services (Flashpoint, Intel 471, Cybersixgill) crawl forums like XSS, Exploit[.]in, BreachForums, and Russian-language cybercriminal communities without analyst exposure.
36
37### Step 2: Manual Investigation with Operational Security
38
39For investigations requiring direct dark web access:
40
41**Environment setup**:
421. Use a dedicated physical machine or air-gapped VM (Whonix + VirtualBox)
432. Connect via Tor Browser only — never via standard browser
443. Use a cover identity with no links to organization
454. Never log in with real credentials to any dark web site
465. Document all sessions in investigation log with timestamps
47
48**Paste site monitoring** (clearnet-accessible, no Tor required):
49```bash
50# Hunt paste sites via API
51curl "https://psbdmp.ws/api/search/company.com" | jq '.data[].id'
52curl "https://pastebin.com/search?q=company.com" # Rate-limited public search
53```
54
55### Step 3: Investigate Ransomware Leak Sites
56
57Ransomware groups maintain .onion leak sites. Monitor these through commercial services rather than direct access. When a claim appears about your organization:
58
591. Capture screenshot evidence via commercial service (do not access directly)
602. Assess legitimacy: Does the threat actor's claimed data align with any known internal systems?
613. Check timestamp: Is this claim recent or historical?
624. Cross-reference with any known security incidents or phishing campaigns from that timeframe
635. Engage IR team if claim appears credible before public disclosure
64
65Known active ransomware leak site operators (as of early 2025): LockBit (disrupted Feb 2024), ALPHV/BlackCat (disrupted Dec 2023), Cl0p, RansomHub, Play.
66
67### Step 4: Credential Exposure Monitoring
68
69For leaked credential monitoring:
70- **Have I Been Pwned Enterprise**: Domain-level notification for credential exposures in breach datasets
71- **SpyCloud**: Commercial credential monitoring with anti-cracking and plaintext password recovery from criminal markets
72- **Flare Systems**: Automated monitoring of paste sites and dark web markets for credential dumps
73
74When credential exposures are confirmed:
751. Force password reset for affected accounts immediately
762. Check if credentials provide access to any organizational systems (SSO, VPN)
773. Review access logs for the period between credential exposure and detection for unauthorized access
78
79### Step 5: Document and Escalate Findings
80
81For each dark web finding:
82- Capture evidence (commercial service screenshot, paste site archive)
83- Classify severity: P1 (imminent attack threat or active data exposure), P2 (credential exposure), P3 (general mention)
84- Notify appropriate stakeholders within defined SLAs
85- Open investigation ticket and link to evidence artifacts
86- Apply TLP:RED for any findings referencing named executives or specific attack plans
87
88## Key Concepts
89
90| Term | Definition |
91|------|-----------|
92| **Dark Web** | Tor-accessible hidden services (.onion domains) not indexed by standard search engines; hosts both legitimate and criminal content |
93| **Paste Site** | Clearnet text-sharing sites (Pastebin, Ghostbin) frequently used to publish stolen data or malware configurations |
94| **Ransomware Leak Site** | .onion site operated by ransomware group to publish stolen victim data as extortion leverage |
95| **Operational Security (OPSEC)** | Protecting analyst identity and organizational affiliation during dark web investigation |
96| **Credential Stuffing** | Automated use of leaked username/password pairs against authentication systems |
97| **Stealer Logs** | Data packages exfiltrated by infostealer malware containing saved browser credentials, cookies, and session tokens |
98
99## Tools & Systems
100
101- **Recorded Future Dark Web Module**: Automated monitoring of dark web sources with alerting on organization-specific keywords
102- **Flashpoint**: Dark web forum monitoring with human intelligence augmentation for criminal community context
103- **Intel 471**: Closed-source access to cybercriminal communities with structured intelligence on threat actors
104- **SpyCloud**: Credential exposure monitoring with recaptured plaintext passwords from criminal markets
105- **Have I Been Pwned Enterprise**: Domain-level breach notification API for credential monitoring at scale
106
107## Common Pitfalls
108
109- **Direct access without OPSEC**: Accessing dark web forums without Tor and a cover identity can expose analyst IP, browser fingerprint, and organization affiliation to adversaries.
110- **Overreacting to unverified claims**: Ransomware groups and forum posters fabricate attack claims for extortion or reputation. Verify before escalating to incident response.
111- **Missing clearnet sources**: Most dark web intelligence programs miss Telegram channels, Discord servers, and paste sites which operate on the clearnet and host significant criminal activity.
112- **Inadequate legal review**: Dark web monitoring must be reviewed by legal counsel — passive monitoring is generally lawful but active participation in criminal markets is not.
113- **No evidence preservation**: Dark web content disappears rapidly. Capture timestamped evidence immediately upon discovery using commercial service exports.
yanacuti1121