performing-paste-site-monitoring-for-credentials

name	performing-paste-site-monitoring-for-credentials
description	Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using automated scraping and keyword matching to detect breaches early.
domain	cybersecurity
subdomain	threat-intelligence
tags	["paste-monitoring","credential-leak","pastebin","data-breach","threat-intelligence","osint","early-warning"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]
mitre_attack	["T1591","T1592","T1593","T1589","T1003"]
source	https://github.com/mukul975/Anthropic-Cybersecurity-Skills
source_commit	04450304b12645cb2b974ab96d28c0664758a88d
note	Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics/threat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.

Performing Paste Site Monitoring for Credentials

Overview

Paste sites (Pastebin, GitHub Gists, Ghostbin, Dpaste, Hastebin) are frequently used as staging areas for leaked credentials, database dumps, API keys, and sensitive data before wider distribution on dark web forums and Telegram channels. Monitoring these sites provides early breach detection, enabling organizations to respond before stolen data is weaponized. This skill covers building automated paste site monitors using the Pastebin Scraping API, keyword-based alerting, credential pattern matching, and integration with incident response workflows.

When to Use

• When conducting security assessments that involve performing paste site monitoring for credentials
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Python 3.9+ with requests, beautifulsoup4, regex, pymisp libraries
• Pastebin PRO account with Scraping API access ($49.95/month for programmatic access)
• GitHub API token for Gist monitoring
• Keyword lists specific to your organization (domains, project names, internal terms)
• Elasticsearch or database for paste storage and search

Key Concepts

Paste Site Threat Landscape

Over 300,000 user credentials are posted on Pastebin annually, averaging 1,000 username/password pairs per leak. Paste sites serve three primary threat intelligence purposes: early breach detection (credentials appear on paste sites before dark web), threat actor profiling (actors use paste sites for C2 configuration, data staging, tool sharing), and malware discovery (encoded payloads, configuration files, C2 addresses).

Monitoring Approaches

Active monitoring queries paste site APIs or scraping endpoints at regular intervals. The Pastebin Scraping API provides real-time access to new public pastes. For GitHub, the search API allows monitoring Gists and repository commits for exposed secrets. Passive monitoring uses services like IntelX, Dehashed, or Have I Been Pwned that aggregate paste site data.

Credential Pattern Detection

Effective monitoring uses regex patterns for email:password combinations, API keys (AWS, Azure, GCP, Stripe, Twilio), database connection strings, private keys (SSH, PGP), JWT tokens, and internal hostnames/URLs. Organization-specific keywords (domain names, product names, employee names) reduce false positives.

Workflow

Step 1: Pastebin Scraping API Monitor

 requests
 re
 json
 time
 datetime  datetime

 :
    SCRAPING_URL = 
    RAW_URL = 

     ():
        .keywords = [k.lower()  k  keywords]
        .output_dir = output_dir
        .seen_keys = ()
        .credential_patterns = {
            : re.(
                , re.IGNORECASE),
            : re.(
                ),
            : re.(
                ),
            : re.(
                ),
            : re.(
                ),
            : re.(
                ),
            : re.(
                ),
            : re.(
                ),
            : re.(
                ,
                re.IGNORECASE),
        }

     ():
        
        params = {: limit}
        :
            resp = requests.get(.SCRAPING_URL, params=params, timeout=)
             resp.status_code == :
                pastes = resp.json()
                ()
                 pastes
            :
                ()
                 []
         Exception  e:
            ()
             []

     ():
        
        params = {: paste_key}
        :
            resp = requests.get(.RAW_URL, params=params, timeout=)
             resp.status_code == :
                 resp.text
             
         Exception:
             

     ():
        
        findings = {
            : [],
            : {},
            : ,
        }

        content_lower = content.lower()

        
         keyword  .keywords:
             keyword  content_lower:
                count = content_lower.count(keyword)
                findings[].append({
                    : keyword,
                    : count,
                })

        
         pattern_name, pattern  .credential_patterns.items():
            matches = pattern.findall(content)
             matches:
                findings[][pattern_name] = {
                    : (matches),
                    : matches[:],
                }

        
        cred_count = (
            m[]  m  findings[].values()
        )
         findings[]  cred_count > :
            findings[] = 
         findings[]:
            findings[] = 
         cred_count > :
            findings[] = 
         cred_count > :
            findings[] = 

         findings

     ():
        
        count = 
         iterations    count < iterations:
            pastes = .fetch_recent_pastes()
            alerts = []

             paste  pastes:
                paste_key = paste.get(, )
                 paste_key  .seen_keys:
                    
                .seen_keys.add(paste_key)

                content = .get_paste_content(paste_key)
                  content:
                    

                findings = .analyze_paste(content, paste)
                 findings[] != :
                    alert = {
                        : paste_key,
                        : paste.get(, ),
                        : paste.get(, ),
                        : paste.get(, ),
                        : paste.get(, ),
                        : ,
                        : findings,
                        : datetime.now().isoformat(),
                    }
                    alerts.append(alert)
                    (
                          )

             alerts:
                ._save_alerts(alerts)

            count += 
             iterations    count < iterations:
                time.sleep(interval)

         alerts

     ():
        
        filename = 
         os
        os.makedirs(.output_dir, exist_ok=)
         (filename, )  f:
            json.dump(alerts, f, indent=)
        ()

monitor = PastebinMonitor(
    keywords=[, , ],
)
alerts = monitor.monitor_loop(interval=, iterations=)