Dark Web Monitoring (Darknet Monitoring)

Dark web monitoring is the continuous surveillance of underground forums, marketplaces, messenger channels, ransomware leak sites and infostealer logs for data that can be attributed to a company: employee and customer credentials, session cookies, infected devices, internal documents and mentions of the company as a target. The goal is to learn about a compromise before it becomes the entry point.

Why dark web monitoring matters

Many ransomware attacks do not start with an exploit but with a valid login. The credentials come from infostealer infections on private or corporate devices, from data breaches at third parties or from phishing. They are traded in combolists and stealer logs and refined by initial access brokers into ready-made network access. Days to weeks often pass between the leak and the attack. Dark web monitoring uses exactly this window: a reset password or a revoked session costs minutes, an incident costs weeks.

Without monitoring, a company usually learns about a leak only once an attacker has already used it.

How dark web monitoring works

• Sources: underground forums and marketplaces, messenger channels, ransomware leak sites, combolists and, above all, stealer logs, the data packages infostealers send from infected devices.
• Matching: hits are matched against the company's domains, email addresses and brands. Good solutions automatically distinguish employee accounts (own domain) from customer accounts (foreign domain, but login on your service).
• Enrichment: source (malware or combolist), infection date, affected device, operating system, installed antivirus software, stealer path and location help with triage. Matching against your own identity directory shows whether the account exists, is privileged and whether the password has been changed since.
• Response: reset passwords, invalidate sessions, isolate the device, enforce MFA, inform customers.

How blacklens.io implements dark web monitoring

blacklens.io reports compromised identities (password, cookie or personal data, with source malware or combolist) and compromised devices (IP, hostname, operating system, antivirus list, stealer path, infection date, geolocation). Hits are classified automatically as employee or customer; expired session cookies are archived automatically. Matching runs every 24 hours by default.

Every leaked username is matched against the user accounts in the IAM inventory, for example from Microsoft 365 or the Active Directory scan with Sentry. You see whether the account is privileged, lacks MFA (Microsoft 365 supplies this) and whether the password has been changed since blacklens.io recorded the leak. A password policy you set in blacklens.io shows which leaked employee passwords meet it and may therefore still be in use. When a username and password pair that is already on record appears again, it is flagged as a known credential and linked to its first occurrence, without a second alert. Stolen session cookies are assessed by the self-hosted AI from the cookie name and its entry in the Open Cookie Database; the cookie value is not used for this.

Ransomware leak sites are checked about every 30 minutes against your supplier watchlist, that is against your suppliers' domains, not against your own scope. The weekly security rating in Supply Chain Monitoring shows a supplier's risk before an attack. Alerts reach you by email, mobile push, Slack, Teams or your ticketing system.

Is dark web monitoring legal?

Yes. It evaluates data that criminals have already published or traded. The operator does not intrude into third-party systems. Hits are processed on behalf of the affected company, which has a legitimate interest in the security of its accounts.

What should you do after a hit?

First check the infection date and the source: a fresh stealer log with a valid session cookie is more urgent than an entry from an old combolist, and a privileged account without MFA is more urgent than a standard account. Then reset the password, terminate active sessions, check MFA and, for compromised devices, rebuild the machine, since stealers often download additional malware.

Is monitoring your own domain enough?

No. Customer accounts on your services, session cookies for SaaS applications such as Microsoft 365 and incidents at suppliers affect you as well. That is why telling employee and customer accounts apart, assessing stolen cookies and keeping an eye on your suppliers belong to complete monitoring: a ransomware watchlist reports an attack on a supplier, and a security rating shows its weaknesses beforehand.