Dark Web Monitoring
Read the Dark Web for Your Name.
Stolen data, network access and plans against named organizations change hands on forums, markets, paste sites, leak sites and chats that search engines don’t index.
Cyber Threat Intelligence gives your team an always-on watch on Deepinfo’s dark web index for the identifiers you choose, and on-demand search for the ones an incident brings.
Forum
Hit
-
Matched onacme.example
A watched domain:
-
Context… accounts on acme.example for sale …
The text around the match:
-
Indicatorsan email, an IP, a crypto address, a CVE ID, a website
-
Sensitive datanone on this page
Warnings That Never Reach Your Logs.
Some of the most useful signals about an attack are posted where your security stack never looks, sometimes before anything touches your network.
Access
Your Network, Offered for Sale
Access brokers advertise footholds by sector and country, and sometimes by the victim’s name.
Data
Your Records, Posted
A dump from your organization, or from a supplier that held your data, can appear on a paste or leak site with no notice to you.
Intent
Your Name, in a Plan
A thread pairing your domain with a fresh CVE, or asking for insiders, is intelligence your logs will never contain.
Watch the Index, Search It and Add Context.
Monitoring keeps the known questions open. Search answers the new ones. Actor profiles and breach records say what a hit means.
Dark Web Mentions Monitoring
Keeps reading the index for your domains, brands and people, and brings each mention with its source, crawl date and the text around it.
Dark Web Search
Queries the index on demand by free text or by indicator: an email address or domain, an IP, a crypto address, a card number, a CVE, a website mention or a named leak.
Threat Actor Intelligence
Profiles record the leaks, forums and markets each actor is tied to, whom it targets and the CVEs and tools it uses.
Data Breach Index
The breaches that include your addresses, with their dates, the data types exposed and how many of your accounts each one holds.
Watchlistacme.example domain Acme brand an executive’s name person
Mentions
forumcredentials for acme.example offered
hackishness 0.9
pasteconfig naming mail.acme.example
hackishness 0.7
chata post naming an Acme executive
hackishness 0.6
Each mention Source · Date · Context · Indicators · Signal
Not a match
marketunrelated listing (not a match)
leakanother company’s files (not a match)
Every Hit Arrives With Its Source.
A hit is the page it was found on, with the fields the index extracts from it, so an analyst can judge it in place and pivot from it.
| Source | Title, URL and source domain, typed as forum, market, paste, leak, chat or IRC |
|---|---|
| Date | When the page was crawled |
| Context | A snippet of the text around the match |
| Indicators | Email addresses, IPs, crypto addresses, CVE IDs and websites found on the same page |
| Sensitive data | Card numbers and Social Security numbers on the page, where present |
| Signal | A hackishness score between 0 and 1 |
Fields as documented in the Darkweb Search reference.
Scope the Watch, Then Hand Off What It Finds.
-
01
Scope
List what points to you: domains and email domains, brand and product names, and the executives your team wants covered.
-
02
Watch
Mentions Monitoring runs those identifiers against the index and surfaces each match with its source and context.
-
03
Triage
Analysts read each hit in place. Addresses on your domain go to credential work, a CVE next to your name goes to vulnerability work.
-
04
Investigate
Search pivots on the other indicators from that page: another email domain, a wallet, an IP address.
-
05
Hand off
Findings move to the team that acts on them: identity, fraud, incident response or the owner of a vendor relationship.
Query This Index From Your Tools.
The dark web index is also available through the Deepinfo API as Darkweb Search, one of the Deep Search & Insights endpoints.
Query by free text or by indicator type, and narrow by source, language, crawl or post date and hackishness.
Request
curl -X POST \
"https://api.deepinfo.com/v1/discovery/darkweb-search?page=1" \
-H "apikey: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"email_apex": ["acme.example"]}'Response
{
"page": 1,
"page_size": 25,
"result_count": 3,
"results": [
{
"title": "████",
"snippet": "… accounts on acme.example for sale …",
"crawl_date": "2026-09-12T14:02:11Z",
"languages": ["en"],
"hackishness": 0.84,
"emails": ["j.•••@acme.example"]
// also: id, url, domain, network, body, forum, groups
}
]
}Questions About Dark Web Monitoring
What is dark web monitoring?
The ongoing search of sources that ordinary search engines don’t index, such as criminal forums, markets, paste sites, leak sites and chat channels, for information about your organization: its domains, brands, people and data.
What’s the difference between monitoring and search?
Monitoring keeps a fixed set of identifiers under watch and brings new matches to you. Search answers a question you have now, often with an identifier an incident has just produced.
Which sources are covered?
The index types each page by source: forum, market, paste, leak, chat or IRC, and records each page’s language, which search can filter on. For coverage questions about a specific region or sector, talk to us.
Does our team need to visit dark web sources?
No. Dark Web Mentions Monitoring and Dark Web Search both read Deepinfo’s index of those sources, so nobody on your team has to browse a forum or market to find a mention.
Can we watch for our executives?
Yes. Executive names can be part of the watch, and Executive Threat Monitoring flags their accounts so breaches and leaked credentials that touch them are handled first.
See What the Dark Web Says About You.
Book a demo and we’ll run dark web queries against your domains and brand names with your team.