Overview#
Most organisations learn about a data breach the hard way: from a journalist, a regulator, or a customer who spotted their data for sale. By then, the breach has often been circulating on dark web forums for days. Dark web monitoring changes that sequence. Security teams at intelligence agencies, financial institutions, healthcare networks, and critical infrastructure operators use continuous dark web surveillance to detect organisational data before it becomes public knowledge, giving them time to investigate, contain, and respond.
Coverage spans thousands of monitored sites with automated content classification, entity extraction, and real-time alerting to security teams. The platform monitors Tor hidden services, I2P eepsites, and alternative darknets, including ransomware leak sites and encrypted Telegram channels used by threat actor communities.
Key Features#
- Marketplace Monitoring: Continuous surveillance across 150+ dark web sites including general marketplaces, carding forums, database leak sites, hacking service providers, and ransomware leak sites
- Credential Leak Detection: Monitor for corporate email credentials, VPN and RDP access sales, cloud service account dumps, API key exposures, and database breach listings
- Ransomware Leak Tracking: Monitor ransomware group leak sites for victim listings, data sample analysis, extortion deadline tracking, and IOC extraction from published data
- Threat Actor Profiling: Track threat actor activity, reputation, capabilities, and targeting patterns across marketplaces and forums with behavioural analysis
- Automated Alerting: Real-time notifications when organisational data, credentials, or brand mentions are detected on dark web sources with severity-based routing
- Content Classification: Automated categorisation of marketplace listings, forum discussions, and leaked data by type, relevance, and threat level
- Evidence Preservation: Screenshot capture and content archival before takedown or deletion for investigation documentation and legal proceedings
- Stealer Log Monitoring: Track infostealer malware output including browser-saved credentials, session cookies, and corporate device indicators
Use Cases#
- Data Breach Early Warning: Detect organisational data appearing on dark web sources before public disclosure, enabling rapid incident response and containment
- Credential Exposure Response: Identify corporate credentials for sale on dark web marketplaces and initiate password reset and access revocation workflows
- Ransomware Intelligence: Monitor ransomware leak sites for extortion attempts targeting the organisation, track negotiation timelines, and assess data exposure scope
- Threat Intelligence Collection: Gather intelligence on threat actors targeting specific industries, track emerging attack tools and techniques, and identify attack planning discussions
- Brand Protection: Detect counterfeit product sales, brand impersonation, and fraudulent service offerings on dark web marketplaces
Integration#
The platform integrates with SIEM and SOAR platforms for automated incident response, identity management systems for credential remediation, and threat intelligence platforms for IOC sharing. Dark web findings export via STIX/TAXII to OpenCTI and MISP for community threat intelligence. The module connects to Cortex (TheHive) for analyst-driven enrichment workflows and feeds directly into the broader Argus OSINT ecosystem for cross-domain intelligence correlation, covering credential exposure alongside breach intelligence, social media, and domain monitoring.
Open Standards#
- STIX 2.1 (OASIS CTI TC): Dark web findings, IOCs, and threat actor profiles are exported in STIX 2.1 object format for sharing with OpenCTI, MISP, and community threat intelligence platforms.
- TAXII 2.1 (OASIS CTI TC): The platform implements TAXII 2.1 feed subscriptions, allowing analysts to pull threat intelligence from external collections and to publish dark web findings to downstream consumers.
- MITRE ATT&CK: Threat actor TTPs extracted from dark web forums and ransomware sites are mapped to MITRE ATT&CK technique and tactic identifiers, enabling structured behavioural profiling and overlap analysis.
- CVE / CVSS (NIST NVD): Vulnerability data surfaced from dark web leak listings is structured against CVE identifiers and CVSS v3 score vectors, providing standardised severity context for affected products.
- GraphQL (June 2018 Specification): All queries, mutations, and alert subscriptions for dark web monitoring are exposed through a typed GraphQL API using the standard query and mutation operation model.
- RFC 7686 (The .onion Special-Use Domain Name): The platform treats .onion hostnames as a distinct source class when crawling Tor hidden services, in conformance with the IANA special-use registration defined in RFC 7686.
- OAuth 2.0 / OpenID Connect (RFC 6749 / OpenID Foundation): API access to dark web monitoring endpoints is gated by RS256-signed JWTs verified against a JWKS endpoint, following the Bearer token pattern defined in OAuth 2.0 and OIDC.
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14