Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using automated scraping and keyword matching to detect breaches early.
Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using automated scraping and keyword matching to detect breaches early.
Paste sites (Pastebin, GitHub Gists, Ghostbin, Dpaste, Hastebin) are frequently used as staging areas for leaked credentials, database dumps, API keys, and sensitive data before wider distribution on dark web forums and Telegram channels. Monitoring these sites provides early breach detection, enabling organizations to respond before stolen data is weaponized. This skill covers building automated paste site monitors using the Pastebin Scraping API, keyword-based alerting, credential pattern matching, and integration with incident response workflows.
When to Use
When conducting security assessments that involve performing paste site monitoring for credentials
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Detection Gaps & Validation
Ephemerality and coverage: the Pastebin Scraping API streams only recent public pastes - private pastes, pastes removed within the polling interval, and content posted elsewhere (Ghostbin, Dpaste, Telegram) never appear. Poll frequently and fetch raw content immediately; a paste can be deleted minutes after posting, so cache it at detection time.
API blind spots: scraping requires a PRO/whitelisted IP, and GitHub code/Gist search is rate-limited and indexes only public, indexed content (not force-pushed-away commits). A "no results" run may mean throttling - log HTTP 403/429 and retry rather than treating an empty result as clean.
Regex false positives: credential patterns match test fixtures, docs examples, AKIAIOSFODNN7EXAMPLE-style placeholders, and expired keys. Require corroboration - an org keyword plus a credential pattern plus a plausible (non-example) value - before raising critical.
Recycled combolists: the same email:password pairs are reposted endlessly, so a hit is often an old breach, not a new one. Dedupe against prior findings and known breaches.
How to confirm: validate that a flagged credential/key is live and actually yours - match the email domain and test the key against the provider's metadata endpoint (non-destructively) to confirm currency before forcing resets.
Prerequisites
Python 3.9+ with requests, beautifulsoup4, regex, pymisp libraries
Pastebin PRO account with Scraping API access ($49.95/month for programmatic access)
GitHub API token for Gist monitoring
Keyword lists specific to your organization (domains, project names, internal terms)
Elasticsearch or database for paste storage and search
Key Concepts
Paste Site Threat Landscape
Over 300,000 user credentials are posted on Pastebin annually, averaging 1,000 username/password pairs per leak. Paste sites serve three primary threat intelligence purposes: early breach detection (credentials appear on paste sites before dark web), threat actor profiling (actors use paste sites for C2 configuration, data staging, tool sharing), and malware discovery (encoded payloads, configuration files, C2 addresses).
Monitoring Approaches
Active monitoring queries paste site APIs or scraping endpoints at regular intervals. The Pastebin Scraping API provides real-time access to new public pastes. For GitHub, the search API allows monitoring Gists and repository commits for exposed secrets. Passive monitoring uses services like IntelX, Dehashed, or Have I Been Pwned that aggregate paste site data.
