Back to Details

monitoring-darkweb-sources

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Monitoring Dark Web Sources

暗网源监控

When to Use

使用场景

Use this skill when:
  • Establishing continuous monitoring for organizational domain names, executive names, and product brands on dark web forums
  • Investigating a reported data breach claim found on a ransomware leak site or paste site
  • Enriching an incident investigation with context about stolen credentials or planned attacks
Do not use this skill without proper operational security measures — dark web browsing without isolation exposes analyst infrastructure to adversary counter-intelligence.
在以下场景中使用该能力：
  • 针对组织域名、高管姓名及产品品牌，在暗网论坛建立持续监控机制
  • 调查勒索软件泄露站点或文本粘贴站点上报告的数据泄露声明
  • 结合被盗凭证或计划攻击的相关背景信息，丰富事件调查内容
请勿在未采取适当操作安全措施的情况下使用该能力——未隔离的暗网浏览会将分析人员的基础设施暴露给对手的反情报手段。

Prerequisites

前提条件

  • Commercial dark web monitoring service (Recorded Future, Flashpoint, Intel 471, or Cybersixgill)
  • Isolated operational environment: Whonix OS or Tails OS running in a VM with no persistent storage
  • Keyword watchlist: organization domain, key executive names, product names, IP ranges, known credentials
  • Legal guidance confirming passive monitoring is authorized in your jurisdiction
  • 商用暗网监控服务（Recorded Future、Flashpoint、Intel 471或Cybersixgill）
  • 隔离操作环境：在无持久化存储的虚拟机中运行Whonix OS或Tails OS
  • 关键词监控列表：组织域名、核心高管姓名、产品名称、IP范围、已知凭证
  • 法律指导确认被动监控在所在司法管辖区内已获授权

Workflow

工作流程

Step 1: Establish Keyword Monitoring via Commercial Services

步骤1：通过商用服务建立关键词监控

Configure dark web monitoring keywords in your CTI platform (e.g., Recorded Future Exposure module):
  • Domain variations: 
    company.com
    , 
    @company.com
    , 
    company[dot]com
  • Executive names: CEO, CISO, CFO full names
  • Product/brand names
  • Internal codenames or project names (if suspected breach scope is broad)
  • Known email domains for credential monitoring
Most commercial services (Flashpoint, Intel 471, Cybersixgill) crawl forums like XSS, Exploit[.]in, BreachForums, and Russian-language cybercriminal communities without analyst exposure.
在你的CTI平台（如Recorded Future Exposure模块）中配置暗网监控关键词：
  • 域名变体：
    company.com
    、
    @company.com
    、
    company[dot]com
  • 高管姓名：CEO、CISO、CFO全名
  • 产品/品牌名称
  • 内部代号或项目名称（若怀疑泄露范围较广）
  • 用于凭证监控的已知邮箱域名
大多数商用服务（Flashpoint、Intel 471、Cybersixgill）会爬取XSS、Exploit[.]in、BreachForums及俄语网络犯罪社区等论坛，无需分析人员直接接触。

Step 2: Manual Investigation with Operational Security

步骤2：遵循操作安全规范开展人工调查

For investigations requiring direct dark web access:
Environment setup:
  1. Use a dedicated physical machine or air-gapped VM (Whonix + VirtualBox)
  2. Connect via Tor Browser only — never via standard browser
  3. Use a cover identity with no links to organization
  4. Never log in with real credentials to any dark web site
  5. Document all sessions in investigation log with timestamps
Paste site monitoring (clearnet-accessible, no Tor required):
bash
undefined
对于需要直接访问暗网的调查：
环境设置：
  1. 使用专用物理机或气隙虚拟机（Whonix + VirtualBox）
  2. 仅通过Tor Browser连接——绝不使用标准浏览器
  3. 使用与组织无关联的掩护身份
  4. 切勿使用真实凭证登录任何暗网站点
  5. 在调查日志中记录所有会话及时间戳
文本粘贴站点监控（可通过明网访问，无需Tor）：
bash
undefined

Hunt paste sites via API

通过API搜索粘贴站点

curl "https://psbdmp.ws/api/search/company.com" | jq '.data[].id' curl "https://pastebin.com/search?q=company.com" # Rate-limited public search
undefined
curl "https://psbdmp.ws/api/search/company.com" | jq '.data[].id' curl "https://pastebin.com/search?q=company.com" # 受速率限制的公开搜索
undefined

Step 3: Investigate Ransomware Leak Sites

步骤3：调查勒索软件泄露站点

Ransomware groups maintain .onion leak sites. Monitor these through commercial services rather than direct access. When a claim appears about your organization:
  1. Capture screenshot evidence via commercial service (do not access directly)
  2. Assess legitimacy: Does the threat actor's claimed data align with any known internal systems?
  3. Check timestamp: Is this claim recent or historical?
  4. Cross-reference with any known security incidents or phishing campaigns from that timeframe
  5. Engage IR team if claim appears credible before public disclosure
Known active ransomware leak site operators (as of early 2025): LockBit (disrupted Feb 2024), ALPHV/BlackCat (disrupted Dec 2023), Cl0p, RansomHub, Play.
勒索软件团伙维护.onion泄露站点。优先通过商用服务监控这些站点，而非直接访问。当出现涉及你方组织的声明时：
  1. 通过商用服务截取截图证据（请勿直接访问）
  2. 评估合法性：威胁行为者声称的数据是否与已知内部系统匹配？
  3. 检查时间戳：该声明是近期发布还是历史内容？
  4. 交叉核对该时间段内已知的安全事件或钓鱼活动
  5. 若声明看似可信，在公开披露前通知事件响应（IR）团队
截至2025年初已知活跃的勒索软件泄露站点运营者：LockBit（2024年2月被捣毁）、ALPHV/BlackCat（2023年12月被捣毁）、Cl0p、RansomHub、Play。

Step 4: Credential Exposure Monitoring

步骤4：凭证暴露监控

For leaked credential monitoring:
  • Have I Been Pwned Enterprise: Domain-level notification for credential exposures in breach datasets
  • SpyCloud: Commercial credential monitoring with anti-cracking and plaintext password recovery from criminal markets
  • Flare Systems: Automated monitoring of paste sites and dark web markets for credential dumps
When credential exposures are confirmed:
  1. Force password reset for affected accounts immediately
  2. Check if credentials provide access to any organizational systems (SSO, VPN)
  3. Review access logs for the period between credential exposure and detection for unauthorized access
针对泄露凭证的监控：
  • Have I Been Pwned Enterprise：针对域名级别的凭证泄露通知，覆盖泄露数据集
  • SpyCloud：商用凭证监控服务，具备反破解功能，可从黑市恢复明文密码
  • Flare Systems：自动监控粘贴站点及暗网市场的凭证泄露情况
确认存在凭证暴露后：
  1. 立即强制重置受影响账户的密码
  2. 检查凭证是否可访问任何组织系统（SSO、VPN）
  3. 审查凭证暴露至检测期间的访问日志，排查未授权访问

Step 5: Document and Escalate Findings

步骤5：记录并上报调查结果

For each dark web finding:
  • Capture evidence (commercial service screenshot, paste site archive)
  • Classify severity: P1 (imminent attack threat or active data exposure), P2 (credential exposure), P3 (general mention)
  • Notify appropriate stakeholders within defined SLAs
  • Open investigation ticket and link to evidence artifacts
  • Apply TLP:RED for any findings referencing named executives or specific attack plans
针对每一项暗网发现：
  • 留存证据（商用服务截图、粘贴站点存档）
  • 划分严重等级：P1（迫在眉睫的攻击威胁或活跃数据暴露）、P2（凭证暴露）、P3（一般性提及）
  • 在规定的服务级别协议（SLA）内通知相关利益相关方
  • 开立调查工单并关联证据 artifacts
  • 若发现涉及指定高管或具体攻击计划的内容，标记为TLP:RED

Key Concepts

核心概念

TermDefinition
Dark WebTor-accessible hidden services (.onion domains) not indexed by standard search engines; hosts both legitimate and criminal content
Paste SiteClearnet text-sharing sites (Pastebin, Ghostbin) frequently used to publish stolen data or malware configurations
Ransomware Leak Site.onion site operated by ransomware group to publish stolen victim data as extortion leverage
Operational Security (OPSEC)Protecting analyst identity and organizational affiliation during dark web investigation
Credential StuffingAutomated use of leaked username/password pairs against authentication systems
Stealer LogsData packages exfiltrated by infostealer malware containing saved browser credentials, cookies, and session tokens
术语定义
Dark Web需通过Tor访问的隐藏服务（.onion域名），未被标准搜索引擎收录；包含合法及非法内容
Paste Site明网文本分享站点（Pastebin、Ghostbin），常被用于发布被盗数据或恶意软件配置
Ransomware Leak Site勒索软件团伙运营的.onion站点，通过发布被盗受害者数据作为勒索筹码
Operational Security (OPSEC)在暗网调查期间保护分析人员身份及组织关联信息
Credential Stuffing自动利用泄露的用户名/密码组合攻击认证系统
Stealer Logs信息窃取恶意软件窃取的数据包，包含保存的浏览器凭证、Cookie及会话令牌

Tools & Systems

工具与系统

  • Recorded Future Dark Web Module: Automated monitoring of dark web sources with alerting on organization-specific keywords
  • Flashpoint: Dark web forum monitoring with human intelligence augmentation for criminal community context
  • Intel 471: Closed-source access to cybercriminal communities with structured intelligence on threat actors
  • SpyCloud: Credential exposure monitoring with recaptured plaintext passwords from criminal markets
  • Have I Been Pwned Enterprise: Domain-level breach notification API for credential monitoring at scale
  • Recorded Future Dark Web Module：自动监控暗网源，针对组织特定关键词发出警报
  • Flashpoint：暗网论坛监控，结合人工情报增强对犯罪社区背景的理解
  • Intel 471：网络犯罪社区的闭源访问权限，提供结构化的威胁行为者情报
  • SpyCloud：凭证暴露监控，可从黑市恢复明文密码
  • Have I Been Pwned Enterprise：域名级别的泄露通知API，实现大规模凭证监控

Common Pitfalls

常见误区

  • Direct access without OPSEC: Accessing dark web forums without Tor and a cover identity can expose analyst IP, browser fingerprint, and organization affiliation to adversaries.
  • Overreacting to unverified claims: Ransomware groups and forum posters fabricate attack claims for extortion or reputation. Verify before escalating to incident response.
  • Missing clearnet sources: Most dark web intelligence programs miss Telegram channels, Discord servers, and paste sites which operate on the clearnet and host significant criminal activity.
  • Inadequate legal review: Dark web monitoring must be reviewed by legal counsel — passive monitoring is generally lawful but active participation in criminal markets is not.
  • No evidence preservation: Dark web content disappears rapidly. Capture timestamped evidence immediately upon discovery using commercial service exports.
  • 未遵循OPSEC直接访问：未通过Tor及掩护身份访问暗网论坛，会将分析人员的IP、浏览器指纹及组织关联信息暴露给对手。
  • 对未验证声明过度反应：勒索软件团伙及论坛发帖者会伪造攻击声明以勒索或破坏声誉，上报至事件响应团队前需先验证。
  • 遗漏明网源：大多数暗网情报项目会遗漏Telegram频道、Discord服务器及粘贴站点，这些明网平台也存在大量犯罪活动。
  • 法律审查不足：暗网监控需经法律顾问审查——被动监控通常合法，但主动参与黑市活动则不合法。
  • 未留存证据：暗网内容会快速消失，发现后需立即通过商用服务导出带时间戳的证据。