skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-dark-web-monitoring-for-threats

Monitors Tor hidden services, paste sites, and ransomware leak sites for leaked credentials and threat mentions.

954|172|Updated Mar 13, 2026
Search Tags:#ransomware#Python#threat intelligence#osint#credential leak#Tor#dark web monitoring
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-dark-web-monitoring-for-threats
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-dark-web-monitoring-for-threats
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/performing-dark-web-monitoring-for-threats
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-dark-web-monitoring-for-threats

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, stem, beautifulsoup4, stix2.

What problem does it solve?

Organizations often learn about leaked credentials, data breaches, or ransomware victim listings only after attackers exploit them. This Skill provides a structured workflow for monitoring dark web sources so security teams can detect threats targeting their organization early and respond before damage occurs.

Core Features & Use Cases

  • Tor-Based Collection: Build a Python requests session routed through the Tor SOCKS5 proxy and verify anonymity via check.torproject.org before collecting intelligence.
  • Credential Leak Monitoring: Query the Have I Been Pwned API and scan onion paste sites for organization domains, keywords, and leaked credentials with contextual snippets.
  • Ransomware Leak Site Tracking: Check Ransomwatch data for mentions of your organization on ransomware group leak sites and generate a structured intelligence report with severity-based recommendations.
  • Use Case: A security analyst suspects corporate credentials are circulating after a third-party breach. They run the monitoring workflow against company domains, confirm whether the leak is new or recycled combolist data, and produce a report recommending password resets and MFA enforcement.

Quick Start

Set up a Tor-routed monitoring session and scan paste sites and ransomware leak sources for mentions of my organization's domains, then generate a dark web intelligence report.

Frequently Asked Questions about performing-dark-web-monitoring-for-threats

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I monitor the dark web for leaked credentials?▼

Route a Python requests session through the Tor SOCKS5 proxy on port 9050, then query the Have I Been Pwned API for your domains and scan onion paste sites for keyword matches. Validate hits against prior dumps to filter out recycled combolists before raising severity.

How to check if my company appears on ransomware leak sites?▼

Fetch the Ransomwatch posts.json dataset and match your organization name against post titles and group names. Treat a listing as confirmed only when the victim name matches plus a known-internal artifact, not a partial name collision.

What Python libraries are needed for dark web monitoring?▼

The workflow uses requests with a socks5h proxy for Tor-routed HTTP, stem for Tor control, beautifulsoup4 for parsing collected pages, and stix2 for structured threat intelligence output. Python 3.9 or later is required.

Can I use commercial APIs instead of crawling Tor sites directly?▼

Yes, commercial services like Flare, SpyCloud, DarkOwl, and Intel 471 provide API-based dark web monitoring without running your own Tor crawlers. However, clearnet aggregators miss invite-only forums and private channels that require vetted personas.

Why does dark web keyword monitoring miss relevant leaks?▼

Actors post in Russian, Farsi, slang, and leetspeak, so English-only keyword matching fails. Normalize and translate content, and match on stable selectors like corporate email domains or internal project codenames rather than the brand name alone.

What OPSEC precautions are required for dark web research?▼

Use an isolated VM with no personal or corporate data, route all traffic through Tor (Whonix or Tails recommended), disable JavaScript, and never authenticate or download files from an attributable host. Use separate personas for any forum registration.

Related Skills

Explore More Software Engineering Skills→
obulaiobulai
1

obul-logo

Search for company logos and brand information by domain via Logo.dev API.

Official
Basic
patricio0312revpatricio0312rev
5

security-incident-playbook-generator

Generate structured security incident response playbooks for containment and evidence collection.

Community
Advanced
Muath2000Muath2000

threat-intel-engineer

Integrate, normalize, and correlate cyber threat data from STIX/TAXII feeds.

Community
Advanced
brucesongsbrucesongs
60

darkweb-intel

Identify onion services, marketplaces, and threat-actor pivots in Tor-enabled environments.

Community
Advanced