Dark Web Mentions Monitoring
See Your Organization’s Name Where Attackers Talk.
Dark Web Mentions Monitoring is the always-on half of dark web coverage. It keeps reading Deepinfo’s dark web index for your domains, brands and people.
Each mention comes with its source, its crawl date and the text around the match.
Watchlistacme.example domain Acme brand an executive’s name person
Mentions
forumcredentials for acme.example offered
hackishness 0.9
pasteconfig naming mail.acme.example
hackishness 0.7
chata post naming an Acme executive
hackishness 0.6
Each mention Source · Date · Context · Indicators · Signal
Not a match
marketunrelated listing (not a match)
leakanother company’s files (not a match)
Nobody searches for a mention they don’t expect.
On-demand search is only as good as the question an analyst thinks to ask. The mentions that matter tend to be the unexpected ones: access to your network offered for sale, a supplier’s files on a leak site, a thread pairing your domain with a fresh CVE.
Mentions Monitoring keeps that question open, so the answer does not depend on someone remembering to ask it.
The Names Worth Watching.
A mention is a page in a dark web source that names something of yours. These are the names that point back to your organization.
Infrastructure
Domains and Email Domains
Your registered domains and the domains your staff send mail from. A post that lists addresses on them usually means a leak somewhere.
Brands
Organization and Product Names
The names your organization, its brands and its products go by, as they appear in thread titles, listings and leak announcements.
People
Executives and Administrators
The people whose names attract targeting: leadership, and the administrators who hold privileged access.
What a Mention Carries With It.
Mentions come from the dark web index that Dark Web Search queries, so each one carries the fields the index keeps for a page.
| Source | The page title, URL and source domain, typed as forum, market, paste, leak, chat or IRC |
|---|---|
| Date | When the page was crawled |
| Context | A snippet of the surrounding text, so the match can be read where it sits |
| Indicators | Email addresses, IPs, crypto addresses, CVE IDs and websites extracted from that page |
| Sensitive data | Card numbers and Social Security numbers found on the page, where present |
| Signal | A hackishness score between 0 and 1 for the page |
Fields as documented for the dark web index in the Darkweb Search reference.
acme.example
Dark web mention
-
1On your watchlist CTIacme.example · domain, in the words around it:
Context… credentials for acme.example offered …
-
2Typed by its sourceforum, market, paste, leak, chat or IRC:
Sourceforum · masked
-
3The crawl, not the postsearch on the post date to tell them apart:
Datethe day Deepinfo read the page
-
Indicatorsemails · IPs · crypto · CVE IDs · websites
-
4How hackish the page readsa score between 0 and 1:
Hackishness0.9
Each mention comes with its source, its crawl date and the text around the match.
Which Mentions to Act on First.
A name on a forum is not an incident. These patterns usually are, and each one has a workflow to hand it to.
Addresses on Your Domain in a Leak
A paste or leak that lists addresses on your email domain is a credential problem before it is anything else.
Access or Data Offered for Sale
A market listing that names your organization. Treat it as a possible intrusion until the evidence says otherwise.
Card Numbers Next to Your Brand
Payment data posted alongside your name can point to a compromise somewhere in your payment path. Check the cards against your payment credential records.
A CVE Next to Your Domain
A thread that pairs a vulnerability with your infrastructure. Check whether that CVE is present on your assets.
Your People, by Name
Executives and administrators named in threat context need their own review.
Query This Data Through the API
Credentials and dark web findings stay in the platform. The domain and vulnerability data around them is open through the API.
Questions About Dark Web Mentions Monitoring
What counts as a dark web mention?
A page in a dark web source that contains one of your identifiers: a forum post, a market listing, a paste or a leak site entry. The identifier can appear as plain text or as a value the index extracts, such as an email address on your domain.
How is it different from Dark Web Search?
Search runs when an analyst asks a question. Mentions Monitoring keeps the question open for your identifiers. Both read the same index, so the other indicators on a mentioned page can be followed up with a search.
Which sources does it read?
Forums, markets, paste sites, chats and leak sites, as indexed by Deepinfo. Each mention is typed by the kind of source it came from.
How do we tell an old dump from a new post?
A mention’s crawl date shows when Deepinfo read the page, not when it was posted. Run a Dark Web Search on the same identifier and filter on the post date to separate new posts from an old dump that has resurfaced.
Does no mention mean nobody is talking about us?
It means nothing was found in the sources Deepinfo indexes. Dark web coverage is partial by nature, as the methodology states.
See Where Your Name Already Comes Up.
Book a demo and bring your domains and brand names. We’ll walk your team through how mentions of them are found, read and triaged.