<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: monitoring-dark-web-sources
description: >-
  Monitor dark web forums, paste sites, and underground marketplaces for
  threat intelligence including leaked credentials, ransomware negotiations,
  and threat actor communications.
domain: cybersecurity
subdomain: threat-intelligence
tags:
  - dark-web
  - osint
  - credential-leaks
  - ransomware
  - underground-markets
  - tor
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1593"]
---
# Monitoring Dark Web Sources

## Overview

Dark web monitoring provides early warning of credential leaks, data breaches,
ransomware victim postings, zero-day sales, and threat actor planning. This skill
covers configuring safe collection infrastructure, monitoring paste sites and
forums, tracking ransomware leak sites, correlating findings with organizational
assets, and producing actionable intelligence from underground sources.

## Prerequisites

- Isolated monitoring infrastructure (VM or container, never corporate network)
- Tor Browser / torsocks for .onion access
- Python 3.10+ with `requests`, `beautifulsoup4`, `stem`
- API access: IntelX, Have I Been Pwned, DarkOwl (commercial)
- Understanding of OPSEC for dark web research
- Legal authorization for monitoring activities

```bash
pip install requests beautifulsoup4 stem pysocks
```

## Key Concepts

### Source Categories

| Source Type | Examples | Intelligence Value |
|------------|---------|-------------------|
| Paste Sites | Pastebin, Ghostbin, rentry.co | Leaked credentials, configs, IOCs |
| Forums | BreachForums, XSS.is, Exploit.in | Actor comms, 0-day sales, service offers |
| Marketplaces | Genesis, Russian Market | Stolen credentials, access brokers |
| Ransomware Leak Sites | LockBit, BlackCat, Cl0p blogs | Victim notifications, stolen data |
| Telegram Channels | Various threat actor channels | Real-time comms, data dumps |

### OPSEC Requirements

**Mandatory for dark web research:**
- Dedicated VM with no personal data (Whonix or Tails recommended)
- Tor network only — never direct connections to .onion
- No JavaScript enabled in Tor Browser (NoScript)
- Never authenticate with real credentials
- No file downloads to host machine (sandbox only)
- VPN before Tor for additional layer (organization-approved)
- Screenshot evidence, not copy-paste (reduces accidental exfil)

### Intelligence Requirements Mapping

```
Organizational Assets → Dark Web Monitoring Queries
├── Email domains     → Credential leak monitoring
├── IP ranges         → Access broker listings
├── Brand names       → Phishing kit sales, fake domains
├── Executive names   → Doxxing, social engineering recon
├── Software stack    → Zero-day/exploit sales
└── Vendor names      → Supply chain compromise indicators
```

## Workflow

### Step 1: Configure Tor Access

```python
import requests
import socks

def create_tor_session() -> requests.Session:
    """Create requests session routed through Tor."""
    session = requests.Session()
    session.proxies = {
        'http': 'socks5h://127.0.0.1:9050',
        'https': 'socks5h://127.0.0.1:9050',
    }
    session.headers.update({
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0',
    })
    return session

def verify_tor(session: requests.Session) -> bool:
    """Verify Tor connection is active."""
    resp = session.get("https://check.torproject.org/api/ip", timeout=30)
    data = resp.json()
    return data.get("IsTor", False)
```

### Step 2: Monitor Paste Sites

```python
from bs4 import BeautifulSoup
import re

def search_paste_sites(session: requests.Session, keywords: list[str]) -> list[dict]:
    """Search paste aggregation services for keywords."""
    results = []
    # IntelX API for paste searching
    for keyword in keywords:
        resp = session.get(
            "https://2.intelx.io/intelligent/search",
            params={"term": keyword, "buckets[]": "pastes", "sort": 2, "media": 0},
            timeout=30,
        )
        if resp.status_code == 200:
            for item in resp.json().get("records", []):
                results.append({
                    "source": "intelx",
                    "keyword": keyword,
                    "name": item.get("name", ""),
                    "date": item.get("date", ""),
                    "bucket": item.get("bucket", ""),
                })
    return results
```

### Step 3: Track Ransomware Leak Sites

```python
import json
from datetime import datetime

def check_ransomware_leaks(session: requests.Session, org_keywords: list[str]) -> list[dict]:
    """Check known ransomware leak site mirrors for organization mentions."""
    # Use ransomware.live API (clearnet mirror of leak data)
    alerts = []
    resp = session.get("https://api.ransomware.live/v2/victims", timeout=30)
    if resp.status_code == 200:
        victims = resp.json()
        for v in victims:
            for keyword in org_keywords:
                if keyword.lower() in v.get("victim", "").lower():
                    alerts.append({
                        "group": v.get("group", ""),
                        "victim": v.get("victim", ""),
                        "date": v.get("date", ""),
                        "url": v.get("url", ""),
                        "match_keyword": keyword,
                    })
    return alerts
```

### Step 4: Credential Leak Monitoring

```python
def check_hibp(email_domain: str, api_key: str) -> list[dict]:
    """Check Have I Been Pwned for domain breaches."""
    resp = requests.get(
        f"https://haveibeenpwned.com/api/v3/breaches",
        headers={"hibp-api-key": api_key},
        params={"domain": email_domain},
        timeout=30,
    )
    if resp.status_code == 200:
        return [{"name": b["Name"], "date": b["BreachDate"],
                 "count": b["PwnCount"], "data_classes": b["DataClasses"]}
                for b in resp.json()]
    return []
```

### Step 5: Alert Generation

```python
def generate_alert(finding: dict, severity: str, context: str) -> dict:
    """Generate structured alert from dark web finding."""
    return {
        "alert_id": f"DW-{datetime.now().strftime('%Y%m%d%H%M%S')}",
        "severity": severity,
        "source": finding.get("source", "dark-web"),
        "context": context,
        "finding": finding,
        "timestamp": datetime.now().isoformat(),
        "recommended_actions": [
            "Verify credential exposure scope",
            "Force password resets for affected accounts",
            "Enable MFA on exposed accounts",
            "Monitor for unauthorized access attempts",
        ],
    }
```

## Detection

```yaml
title: Dark Web Sources Detection
id: 3a155706-c867-4c09-9310-928ab1c8a0a3
status: experimental
description: Detects suspicious activity related to monitoring dark web sources techniques in threat intelligence context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1593
  - attack.reconnaissance
falsepositives:
  - Threat intelligence platform aggregating feeds from approved sources
```

## Verification

- [ ] Tor connection verified before any dark web access
- [ ] Monitoring queries match organizational intelligence requirements
- [ ] Paste site searches return relevant results for monitored keywords
- [ ] Ransomware leak site checks run on automated schedule
- [ ] Credential leak alerts include scope and remediation steps
- [ ] All monitoring conducted from isolated infrastructure with proper OPSEC

## References

- [Have I Been Pwned API](https://haveibeenpwned.com/API/v3)
- [IntelX API](https://intelx.io/integrations)
- [Ransomware.live](https://www.ransomware.live/)
- [Tor Project](https://www.torproject.org/)
- [Whonix](https://www.whonix.org/)
