What is dark web monitoring for companies?

Dark web monitoring (also darknet monitoring) watches underground forums and marketplaces, stealer logs, combolists and ransomware leak sites for data that belongs to your company: email addresses and passwords of your domains, session cookies, personal data, infected corporate devices and mentions of your suppliers. blacklens.io attributes every hit to employees or customers, matches it against your IAM inventory and turns it into an alert with a concrete recommendation.

How quickly will I learn about a hit?

Ransomware leak sites are polled roughly every 30 minutes. Compromised identities and devices are checked every 24 hours by default. New hits generate an alert that is delivered within minutes by email, push notification in the mobile app or through your integrations. If a known username and password pair resurfaces, it is flagged without raising a second alert.

What is the difference between a stealer log and a combolist?

A stealer log comes from malware on a specific device and often contains session cookies, browser data and system information in addition to credentials. The password is current and the device is still infected. A combolist is a compilation of older data breaches, often with outdated passwords. blacklens.io shows the source for every hit and provides device details for stealer logs so you can handle password and device together.

Why are stolen session cookies so critical?

With a valid session cookie an attacker logs in without a password and without a second factor. blacklens.io assesses cookies by name using the Open Cookie Database and its own AI, flags expired cookies and archives them automatically. For valid cookies you should terminate the affected sessions immediately.

What do I need to start dark web monitoring?

Your domains are enough. The platform recognises all addresses of those domains in the monitored sources. To match hits against your IAM inventory, connect Microsoft 365 or use the Active Directory scan of the Sentry agent. For the supplier watchlist you import your suppliers as CSV. Licensing is based on the number of monitored mailboxes.

Is my data sent to external AI services?

No. Cookies and other hits are assessed by a self-hosted LLM run by blacklens.io in the EU. No external AI providers are involved, and AI features are enabled explicitly per workspace. For session cookies, only the cookie name is evaluated and matched against the Open Cookie Database.

What details does blacklens.io provide about compromised devices?

Compromised devices are computers on which infostealer malware has harvested credentials. From the stealer log, blacklens.io shows the IP address, hostname, operating system, installed antivirus products, stealer path, infection date and location, plus the identities that came from that device. This lets the helpdesk identify, isolate and clean the device instead of only resetting the password.

How does blacklens.io monitor ransomware leak sites and suppliers?

Ransomware leak-site monitoring records new victims published by extortion groups roughly every 30 minutes, with company, sector, domain, threat actor, country, link to the post and screenshot. blacklens.io matches these entries against your supplier watchlist, which you import and export as CSV. If a supplier appears on a leak site, you receive the alert "Ransomware threat discovered". With "Monitor in Supply Chain" you can also add suppliers to the supplier risk rating, which assesses their risk before an attack.

How does blacklens.io match dark web hits against our accounts?

Every leaked username is matched against the user accounts in your IAM inventory, by account name or email address and only within your workspace. Microsoft 365 supplies MFA capability, account status, directory roles and the last password change through the integration. Active Directory supplies admin rights and the last password change through the Sentry AD scan and is matched by email address. Unknown values are never treated as safe. The match is refreshed after every dark web, AD and cloud scan; posture changes raise no alert of their own.

Is a password sent anywhere when I test the password policy?

No. The "Try a password" field tests locally in your browser; nothing is sent or stored. You set the password policy in blacklens.io, it is not imported from Active Directory or Entra ID: minimum length, excluded terms such as the company name, required character classes or your own regular expression. Saving re-checks all stored cleartext passwords, and new finds are checked on import. "Policy compliant" means a leaked password meets your rules and may still be in use.

Dark web monitoring

Find leaked access before anyone uses it

Credentials, stealer logs and corporate access are traded long before an incident. blacklens.io finds hits for your domains, matches them against your accounts and tells you what to do.

Start free trial Run the exposure check

Dark web monitoring in blacklens.io: compromised identities list with stats bar and IAM column

Visuals show sample data.

polling interval for ransomware leak sites: ~30 min
ransomware victims recorded since 2023: 20,000+
ransomware groups on watch: 290+
countries covered by leak-site monitoring: 125+

Compromised identities and devices

Credentials, session cookies and personal data for your domains, with source and infected device.

Compromised identities3 new hits

m.hu•••@beispiel-gmbh.atStealer log, 2 h agoEmployee

Microsoft 365 session cookieStealer log, 5 h agoEmployee

k.wa•••@gmx.atCombolist, 3 days agoCustomer

Compromised devicesfrom a stealer log

NB-VERTRIEB-07Windows 11 ProInfected

IP address: 198.51.100.23
Country: Austria
Antivirus: Microsoft Defender
Infection: 4 days ago

Stealer pathC:\Users\mhuber\AppData\Local\Temp\

3 credentials and 2 session cookies found

Session cookiesAI assessment

ESTSAUTHPERSISTENTMicrosoft 365, sign-in sessionCritical

SVPNCOOKIESSL VPN, sessionHigh

_gaWeb analytics, no sessionInfo

Assessed by cookie name (Open Cookie Database)

Visuals show sample data.

Every hit matched against your IAM inventory

blacklens.io matches every leaked username against the accounts in your IAM inventory: Microsoft 365 through the integration, Active Directory by email address from the Sentry AD scan. Missing data is never treated as safe.

Compromised identity detail in blacklens.io: "IAM posture" showing a privileged account, not MFA capable, password not changed since the leak

Visuals show sample data.

Privileged accounts stand out
A directory role in Microsoft 365 or admin rights in AD flag the hit as privileged.
MFA and account status
For Microsoft 365 you see whether the account is MFA-capable and whether it is disabled.
Password changed since the leak?
The last password change is compared with the day blacklens.io recorded the leak.

Check leaked passwords against your policy

Set a minimum length, excluded terms such as your company name and required character classes, or write a regular expression. Every leaked cleartext password is checked against it.

Password policyleaked passwords

Minimum length12 characters

Excluded termsbeispiel

Must containA–Za–z0–9#?!

Try a password, in your browser onlyBeispiel2026!Violates policy

m.hu•••@beispiel-gmbh.atStealer log, may still be in useCompliant

j.ma•••@beispiel-gmbh.atCombolistViolates policy

s.gr•••@beispiel-gmbh.atresurfaced, no second alertKnown credential

Visuals show sample data.

"Policy compliant" is a warning sign
A leaked password that meets your policy may still be in use.
Tested in your browser
The test field checks passwords in your browser. Nothing is sent or stored.
Known credentials
If the same username and password pair resurfaces, it is flagged without a second alert.

Spot ransomware attacks on your suppliers

Ransomware groups publish their victims on leak sites. blacklens.io matches new entries against your supplier watchlist and reports every hit. To see how secure a supplier is before an attack, use the supplier risk rating.

Explore the supplier risk rating

Supplier watchlist12 suppliers

Logistik Partner GmbHListed on a ransomware leak site, 30 min agoCritical

Software Zulieferer AGSoftwareNo hits

Muster SteuerberatungTax advisoryNo hits

Visuals show sample data.

Ransomware leak sites
New victims recorded roughly every 30 minutes with threat actor, country and screenshot.
Supplier watchlist
Import your suppliers via CSV. A match raises the alert "Ransomware threat discovered".
From watchlist to rating
With "Monitor in Supply Chain", suppliers get a security grade from A to F every week.

From hit to response

A dark web hit is an alert like any other, with severity, owner and status. It reaches your team where they work.

Notification policydark web, high and above

Compromised identitym.hu•••@beispiel-gmbh.atCritical

Email to IT managementDelivered

Push in the mobile appDelivered

Microsoft TeamsDelivered

Jira ticketDelivered

Visuals show sample data.

Email, push and integrations
Policies by severity and type, via email, mobile app, Teams, Slack or Sentinel.
Next to your vulnerabilities
A leaked VPN password and a flaw in the VPN gateway appear side by side.
Exportable and auditable
CSV and PDF export, plus an activity log of who handled which hit and when.

Frequently asked questions

: Dark web monitoring (also darknet monitoring) watches underground forums and marketplaces, stealer logs, combolists and ransomware leak sites for data that belongs to your company: email addresses and passwords of your domains, session cookies, personal data, infected corporate devices and mentions of your suppliers. blacklens.io attributes every hit to employees or customers, matches it against your IAM inventory and turns it into an alert with a concrete recommendation.
: Ransomware leak sites are polled roughly every 30 minutes. Compromised identities and devices are checked every 24 hours by default. New hits generate an alert that is delivered within minutes by email, push notification in the mobile app or through your integrations. If a known username and password pair resurfaces, it is flagged without raising a second alert.
: A stealer log comes from malware on a specific device and often contains session cookies, browser data and system information in addition to credentials. The password is current and the device is still infected. A combolist is a compilation of older data breaches, often with outdated passwords. blacklens.io shows the source for every hit and provides device details for stealer logs so you can handle password and device together.
: With a valid session cookie an attacker logs in without a password and without a second factor. blacklens.io assesses cookies by name using the Open Cookie Database and its own AI, flags expired cookies and archives them automatically. For valid cookies you should terminate the affected sessions immediately.
: Your domains are enough. The platform recognises all addresses of those domains in the monitored sources. To match hits against your IAM inventory, connect Microsoft 365 or use the Active Directory scan of the Sentry agent. For the supplier watchlist you import your suppliers as CSV. Licensing is based on the number of monitored mailboxes.
: No. Cookies and other hits are assessed by a self-hosted LLM run by blacklens.io in the EU. No external AI providers are involved, and AI features are enabled explicitly per workspace. For session cookies, only the cookie name is evaluated and matched against the Open Cookie Database.
: Compromised devices are computers on which infostealer malware has harvested credentials. From the stealer log, blacklens.io shows the IP address, hostname, operating system, installed antivirus products, stealer path, infection date and location, plus the identities that came from that device. This lets the helpdesk identify, isolate and clean the device instead of only resetting the password.
: Ransomware leak-site monitoring records new victims published by extortion groups roughly every 30 minutes, with company, sector, domain, threat actor, country, link to the post and screenshot. blacklens.io matches these entries against your supplier watchlist, which you import and export as CSV. If a supplier appears on a leak site, you receive the alert "Ransomware threat discovered". With "Monitor in Supply Chain" you can also add suppliers to the supplier risk rating, which assesses their risk before an attack.
: Every leaked username is matched against the user accounts in your IAM inventory, by account name or email address and only within your workspace. Microsoft 365 supplies MFA capability, account status, directory roles and the last password change through the integration. Active Directory supplies admin rights and the last password change through the Sentry AD scan and is matched by email address. Unknown values are never treated as safe. The match is refreshed after every dark web, AD and cloud scan; posture changes raise no alert of their own.
: No. The "Try a password" field tests locally in your browser; nothing is sent or stored. You set the password policy in blacklens.io, it is not imported from Active Directory or Entra ID: minimum length, excluded terms such as the company name, required character classes or your own regular expression. Saving re-checks all stored cleartext passwords, and new finds are checked on import. "Policy compliant" means a leaked password meets your rules and may still be in use.

Is your company already on the dark web?

14 days free. We set up monitoring for your domains and go through the first hits with you.

Try free for 14 days Book a demo

14 days free, all features
No credit card required
We walk you through your first findings

Find leaked access before anyone uses it

Compromised identities and devices

Every hit matched against your IAM inventory

Check leaked passwords against your policy

Spot ransomware attacks on your suppliers

From hit to response

Frequently asked questions

Related solutions

Is your company already on the dark web?