Performing Dark Web Monitoring for Threats

Overview

Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked credentials, data breaches, threat actor discussions, vulnerability exploitation tools, and planned attacks. This skill covers setting up monitoring infrastructure, using Tor-based collection tools, implementing automated alerting for brand mentions and credential leaks, and analyzing dark web intelligence for actionable threat indicators.

When to Use

• When conducting security assessments that involve performing dark web monitoring for threats
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Tor Browser and Tor proxy (SOCKS5 on port 9050)
• Python 3.9+ with requests, stem, beautifulsoup4, stix2 libraries
• Understanding of Tor hidden service architecture (.onion domains)
• API access to dark web monitoring services (Flare, SpyCloud, DarkOwl, Intel 471)
• Awareness of legal and ethical boundaries for dark web research
• Isolated VM for dark web browsing (no personal or corporate identity leakage)

Key Concepts

Dark Web Intelligence Sources

• Underground Forums: Hacking forums where threat actors discuss TTPs, sell exploits, and share tools
• Paste Sites: Platforms for sharing stolen data, credentials, and code snippets
• Marketplaces: Dark web markets selling stolen data, RaaS, exploit kits, and access
• Telegram/Discord: Alternative communication channels for cybercriminal groups
• Ransomware Leak Sites: Blogs where ransomware groups post stolen data from victims

Collection Methods

• Automated Crawling: Tor-based web crawlers scanning hidden services
• API-Based Monitoring: Commercial dark web monitoring APIs (Flare, DarkOwl, Intel 471)
• Manual HUMINT: Analyst-driven research on specific forums and marketplaces
• Credential Monitoring: Breach databases and paste site monitoring for leaked credentials

OPSEC for Dark Web Research

• Use dedicated VMs with no personal data
• Route all traffic through Tor (Whonix or Tails recommended)
• Never use personal accounts or identifiable information
• Use separate email addresses and personas for forum registration
• Disable JavaScript in Tor Browser for enhanced security
• Never download or execute files from dark web sources on production systems

Workflow

Step 1: Set Up Tor-Based HTTP Client

import requests
from requests.adapters import HTTPAdapter

def create_tor_session():
    """Create a requests session routed through Tor SOCKS5 proxy."""
    session = requests.Session()
    session.proxies = {
        "http": "socks5h://127.0.0.1:9050",
        "https": "socks5h://127.0.0.1:9050",
    }
    session.headers.update({
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0",
    })
    return session


def verify_tor_connection(session):
    """Verify that traffic is routed through Tor."""
    try:
        resp = session.get("https://check.torproject.org/api/ip", timeout=30)
        data = resp.json()
        return {
            "is_tor": data.get("IsTor", False),
            "ip": data.get("IP", ""),
        }
    except Exception as e:
        return {"error": str(e)}

Step 2: Monitor Paste Sites for Credential Leaks

import re
from datetime import datetime

def monitor_paste_sites(session, organization_domains):
    """Monitor paste sites for leaked credentials matching organization domains."""
    findings = []

    # Check Have I Been Pwned API (clearnet)
    for domain in organization_domains:
        try:
            resp = requests.get(
                f"https://haveibeenpwned.com/api/v3/breaches",
                headers={"hibp-api-key": "YOUR_HIBP_KEY"},
                timeout=30,
            )
            if resp.status_code == 200:
                breaches = resp.json()
                for breach in breaches:
                    if domain.lower() in breach.get("Domain", "").lower():
                        findings.append({
                            "source": "HIBP",
                            "breach_name": breach["Name"],
                            "breach_date": breach.get("BreachDate"),

…