| name | monitoring-darkweb-sources |
| description | Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide early warning intelligence. Use when establishing dark web monitoring coverage, investigating specific data breach claims, or enriching incident investigations with dark web context. Activates for requests involving dark web OSINT, leak site monitoring, credential exposure, Recorded Future dark web, or Tor hidden service intelligence.
|
| domain | cybersecurity |
| subdomain | threat-intelligence |
| tags | ["dark-web","OSINT","credential-monitoring","ransomware-leaks","Recorded-Future","SpiderFoot","CTI"] |
| version | 1.0.0 |
| author | team-cybersecurity |
| license | Apache-2.0 |
| nist_ai_rmf | ["MEASURE-2.7","MAP-5.1","MANAGE-2.4"] |
| atlas_techniques | ["AML.T0070","AML.T0066","AML.T0082"] |
| nist_csf | ["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"] |
| mitre_attack | ["T1591","T1592","T1593","T1589","T1003"] |
| mitre_f3 | {"version":"1.1","tactics":["reconnaissance","resource-development","initial-access"],"techniques":[{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"T1650","name":"Acquire Access","tactic":"resource-development","source":"attack"},{"id":"T1555.003","name":"Credentials from Password Stores: Credentials from Web Browsers","tactic":"reconnaissance","source":"attack"},{"id":"F1029","name":"Gather Customer Information","tactic":"reconnaissance","source":"f3"},{"id":"T1110.004","name":"Brute Force: Credential Stuffing","tactic":"initial-access","source":"attack"}]} |
Monitoring Dark Web Sources
When to Use
Use this skill when:
- Establishing continuous monitoring for organizational domain names, executive names, and product brands on dark web forums
- Investigating a reported data breach claim found on a ransomware leak site or paste site
- Enriching an incident investigation with context about stolen credentials or planned attacks
Do not use this skill without proper operational security measures — dark web browsing without isolation exposes analyst infrastructure to adversary counter-intelligence.
Prerequisites
- Commercial dark web monitoring service (Recorded Future, Flashpoint, Intel 471, or Cybersixgill)
- Isolated operational environment: Whonix OS or Tails OS running in a VM with no persistent storage
- Keyword watchlist: organization domain, key executive names, product names, IP ranges, known credentials
- Legal guidance confirming passive monitoring is authorized in your jurisdiction
Workflow
Step 1: Establish Keyword Monitoring via Commercial Services
Configure dark web monitoring keywords in your CTI platform (e.g., Recorded Future Exposure module):
- Domain variations:
company.com, @company.com, company[dot]com
- Executive names: CEO, CISO, CFO full names
- Product/brand names
- Internal codenames or project names (if suspected breach scope is broad)
- Known email domains for credential monitoring
Most commercial services (Flashpoint, Intel 471, Cybersixgill) crawl forums like XSS, Exploit[.]in, BreachForums, and Russian-language cybercriminal communities without analyst exposure.
Step 2: Manual Investigation with Operational Security
For investigations requiring direct dark web access:
Environment setup:
- Use a dedicated physical machine or air-gapped VM (Whonix + VirtualBox)
- Connect via Tor Browser only — never via standard browser
- Use a cover identity with no links to organization
- Never log in with real credentials to any dark web site
- Document all sessions in investigation log with timestamps
Paste site monitoring (clearnet-accessible, no Tor required):
curl "https://psbdmp.ws/api/search/company.com" | jq '.data[].id'
curl
