What is dark web monitoring for companies?

Dark web monitoring (also darknet monitoring) watches underground marketplaces, stealer logs, combolists, paste services and ransomware leak sites for data that belongs to your company: email addresses and passwords of your domains, session cookies, personal data, infected corporate devices and mentions of your suppliers. blacklens.io attributes every hit to employees or customers and turns it into an alert with a concrete recommendation.

How quickly will I learn about a hit?

Ransomware leak sites are polled roughly every 30 minutes. Compromised identities, devices and data leaks are checked every 24 hours by default. New hits generate an alert that is delivered within minutes by email, push notification in the mobile app or through your integrations.

What is the difference between a stealer log and a combolist?

A stealer log comes from malware on a specific device and often contains session cookies, browser data and system information in addition to credentials. The password is current and the device is still infected. A combolist is a compilation of older data breaches, often with outdated passwords. blacklens.io shows the source for every hit and provides device details for stealer logs so you can handle password and device together.

Why are stolen session cookies so critical?

With a valid session cookie an attacker logs in without a password and without a second factor. blacklens.io assesses cookies by name using the Open Cookie Database and its own AI, flags expired cookies and archives them automatically. For valid cookies you should terminate the affected sessions immediately.

What do I need to start dark web monitoring?

Your domains are enough. The platform recognises all addresses of those domains in the monitored sources. For supply chain monitoring you also maintain a list of your suppliers, which can be imported as CSV. Licensing is based on the number of monitored mailboxes.

Is my data sent to external AI services?

No. Cookies and other hits are assessed by a self-hosted LLM run by blacklens.io in the EU. No external AI providers are involved, and AI features are enabled explicitly per workspace. For session cookies, only the cookie name is evaluated and matched against the Open Cookie Database.

What details does blacklens.io provide about compromised devices?

Compromised devices are computers on which infostealer malware has harvested credentials. From the stealer log, blacklens.io shows the IP address, hostname, operating system, installed antivirus products, stealer path, infection date and location, plus the identities that came from that device. This lets the helpdesk identify, isolate and clean the device instead of only resetting the password.

How does blacklens.io monitor ransomware leak sites and suppliers?

Ransomware leak-site monitoring records new victims published by extortion groups roughly every 30 minutes, with company, sector, domain, threat actor, country, link to the post and screenshot. blacklens.io matches these entries against your supplier watchlist, which you import and export as CSV. If a supplier appears on a leak site, you receive the alert "Potential Supply Chain Ransomware Threat" and can assess your own exposure.

Dark web monitoring

Find leaked access before anyone uses it

Credentials, stealer logs and corporate access are traded long before an incident. blacklens.io finds hits for your domains and tells you what to lock, reset or investigate.

Start free trial Run the exposure check

Find leaked access before anyone uses it

polling interval for ransomware leak sites: 24/7
ransomware victims recorded since 2023: 20,000+
ransomware groups on watch: 290+
countries covered by leak-site monitoring: 125+

Compromised identities and devices

Credentials, session cookies and personal data for your domains, with source and infected device.

Compromised identities3 new hits

m.hu•••@beispiel-gmbh.atStealer log, 2 h agoEmployee

Microsoft 365 session cookieStealer log, 5 h agoEmployee

k.wa•••@gmx.atCombolist, 3 days agoCustomer

Compromised devicesfrom a stealer log

NB-VERTRIEB-07Windows 11 ProInfected

IP address: 198.51.100.23
Country: Austria
Antivirus: Microsoft Defender
Infection: 4 days ago

Stealer pathC:\Users\mhuber\AppData\Local\Temp\

3 credentials and 2 session cookies found

Session cookiesAI assessment

ESTSAUTHPERSISTENTMicrosoft 365, sign-in sessionCritical

SVPNCOOKIESSL VPN, sessionHigh

_gaWeb analytics, no sessionInfo

Assessed by cookie name (Open Cookie Database)

Visuals show sample data.

Data leaks and ransom threats in the supply chain

Ransomware groups publish victims on leak sites, and internal documents surface in open sources. blacklens.io watches both, for your suppliers too.

Supplier watchlist12 suppliers

Logistik Partner GmbHListed on a ransomware leak site, 30 min agoCritical

Software Zulieferer AGSoftwareNo hits

Muster SteuerberatungTax advisoryNo hits

Visuals show sample data.

Ransomware leak sites
New victims recorded roughly every 30 minutes with threat actor, country and screenshot.
Supplier watchlist
Import your suppliers via CSV. A match triggers a supply chain ransomware alert.
Data leaks in open sources
Google dorks, Pastebin and open S3 buckets are checked for content about your company.

From hit to response

A dark web hit is an alert like any other, with severity, owner and status. It reaches your team where they work.

Notification policydark web, high and above

Compromised identitym.hu•••@beispiel-gmbh.atCritical

Email to IT managementDelivered

Push in the mobile appDelivered

Microsoft TeamsDelivered

Jira ticketDelivered

Visuals show sample data.

Email, push and integrations
Policies by severity and type, via email, mobile app, Teams, Slack or Sentinel.
Next to your vulnerabilities
A leaked VPN password and a flaw in the VPN gateway appear side by side.
Exportable and auditable
CSV and PDF export, plus an activity log of who handled which hit and when.

Frequently asked questions

: Dark web monitoring (also darknet monitoring) watches underground marketplaces, stealer logs, combolists, paste services and ransomware leak sites for data that belongs to your company: email addresses and passwords of your domains, session cookies, personal data, infected corporate devices and mentions of your suppliers. blacklens.io attributes every hit to employees or customers and turns it into an alert with a concrete recommendation.
: Ransomware leak sites are polled roughly every 30 minutes. Compromised identities, devices and data leaks are checked every 24 hours by default. New hits generate an alert that is delivered within minutes by email, push notification in the mobile app or through your integrations.
: A stealer log comes from malware on a specific device and often contains session cookies, browser data and system information in addition to credentials. The password is current and the device is still infected. A combolist is a compilation of older data breaches, often with outdated passwords. blacklens.io shows the source for every hit and provides device details for stealer logs so you can handle password and device together.
: With a valid session cookie an attacker logs in without a password and without a second factor. blacklens.io assesses cookies by name using the Open Cookie Database and its own AI, flags expired cookies and archives them automatically. For valid cookies you should terminate the affected sessions immediately.
: Your domains are enough. The platform recognises all addresses of those domains in the monitored sources. For supply chain monitoring you also maintain a list of your suppliers, which can be imported as CSV. Licensing is based on the number of monitored mailboxes.
: No. Cookies and other hits are assessed by a self-hosted LLM run by blacklens.io in the EU. No external AI providers are involved, and AI features are enabled explicitly per workspace. For session cookies, only the cookie name is evaluated and matched against the Open Cookie Database.
: Compromised devices are computers on which infostealer malware has harvested credentials. From the stealer log, blacklens.io shows the IP address, hostname, operating system, installed antivirus products, stealer path, infection date and location, plus the identities that came from that device. This lets the helpdesk identify, isolate and clean the device instead of only resetting the password.
: Ransomware leak-site monitoring records new victims published by extortion groups roughly every 30 minutes, with company, sector, domain, threat actor, country, link to the post and screenshot. blacklens.io matches these entries against your supplier watchlist, which you import and export as CSV. If a supplier appears on a leak site, you receive the alert "Potential Supply Chain Ransomware Threat" and can assess your own exposure.

Is your company already on the dark web?

14 days free. We set up monitoring for your domains and go through the first hits with you.

Try free for 14 days Book a demo

14 days free, all features
No credit card required
We walk you through your first findings

Find leaked access before anyone uses it

Compromised identities and devices

Data leaks and ransom threats in the supply chain

From hit to response

Frequently asked questions

Related solutions

Is your company already on the dark web?