What it does. Dark web monitoring involves systematically scanning Tor hidden services, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-dark-web-monitoring-for-threats/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-dark-web-monitoring-for-threats, or copy the skill folder into ~/.claude/skills/performing-dark-web-monitoring-for-threats/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dark-web-monitoring-for-threats/SKILL.md

SKILL.md (verbatim)

name: performing-dark-web-monitoring-for-threats
description: Dark web monitoring involves systematically scanning Tor hidden services,
  underground forums, paste sites, and dark web marketplaces to identify threats targeting
  an organization, including leaked cre
domain: cybersecurity
subdomain: threat-intelligence
tags:
- threat-intelligence
- cti
- ioc
- mitre-attack
- stix
- dark-web
- tor
- threat-monitoring
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-05
- DE.CM-01
- DE.AE-02
mitre_attack:
- T1591
- T1592
- T1593
- T1589

Performing Dark Web Monitoring for Threats

Overview

Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked credentials, data breaches, threat actor discussions, vulnerability exploitation tools, and planned attacks. This skill covers setting up monitoring infrastructure, using Tor-based collection tools, implementing automated alerting for brand mentions and credential leaks, and analyzing dark web intelligence for actionable threat indicators.

When to Use

• When conducting security assessments that involve performing dark web monitoring for threats
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Tor Browser and Tor proxy (SOCKS5 on port 9050)
• Python 3.9+ with requests, stem, beautifulsoup4, stix2 libraries
• Understanding of Tor hidden service architecture (.onion domains)
• API access to dark web monitoring services (Flare, SpyCloud, DarkOwl, Intel 471)
• Awareness of legal and ethical boundaries for dark web research
• Isolated VM for dark web browsing (no personal or corporate identity leakage)

Key Concepts

Dark Web Intelligence Sources

• Underground Forums: Hacking forums where threat actors discuss TTPs, sell exploits, and share tools
• Paste Sites: Platforms for sharing stolen data, credentials, and code snippets
• Marketplaces: Dark web markets selling stolen data, RaaS, exploit kits, and access
• Telegram/Discord: Alternative communication channels for cybercriminal groups
• Ransomware Leak Sites: Blogs where ransomware groups post stolen data from victims

Collection Methods

• Automated Crawling: Tor-based web crawlers scanning hidden services
• API-Based Monitoring: Commercial dark web monitoring APIs (Flare, DarkOwl, Intel 471)
• Manual HUMINT: Analyst-driven research on specific forums and marketplaces
• Credential Monitoring: Breach databases and paste site monitoring for leaked credentials

OPSEC for Dark Web Research

• Use dedicated VMs with no personal data
• Route all traffic through Tor (Whonix or Tails recommended)
• Never use personal accounts or identifiable information
• Use separate email addresses and personas for forum registration
• Disable JavaScript in Tor Browser for enhanced security
• Never download or execute files from dark web sources on production systems

Workflow

Step 1: Set Up Tor-Based HTTP Client

import requests
from requests.adapters import HTTPAdapter

def create_tor_session():
    """Create a requests session routed through Tor SOCKS5 proxy."""
    session = requests.Session()
    session.proxies = {
        "http": "socks5h://127.0.0.1:9050",
        "https": "socks5h://127.0.0.1:9050",
    }
    session.headers.update({
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0",
    })
    return session


def verify_tor_connection(session):
    """Verify that traffic is routed through Tor."""
    try:
        resp = session.get("https://check.torproject.org/api/ip", timeout=30)
        data = resp.json()
        return {
            "is_tor": data.get("IsTor", False),
            "ip": data.get("IP", ""),
        }
    except Exception as e:
        return {"error": str(e)}

Step 2: Monitor Paste Sites for Credential Leaks

import re
from datetime import datetime

def monitor_paste_sites(session, organization_domains):
    """Monitor paste sites for leaked credentials matching organization domains."""
    findings = []

    # Check Have I Been Pwned API (clearnet)
    for domain in organization_domains:
        try:
            resp = requests.get(
                f"https://haveibeenpwned.com/api/v3/breaches",
                headers={"hibp-api-key": "YOUR_HIBP_KEY"},
                timeout=30,
            )
            if resp.status_code == 200:
                breaches = resp.json()
                for breach in breaches:
                    if domain.lower() in breach.get("Domain", "").lower():
                        findings.append({
                            "source": "HIBP",
                            "breach_name": breach["Name"],
                            "breach_date": breach.get("BreachDate"),
                            "data_classes": breach.get("DataClasses", []),
                            "pwn_count": breach.get("PwnCount", 0),
                            "domain": domain,
                        })
        except Exception as e:
            print(f"[-] HIBP error for {domain}: {e}")

    return findings


def search_for_keywords(session, keywords, onion_paste_urls):
    """Search dark web paste sites for specific keywords."""
    results = []

    for paste_url in onion_paste_urls:
        try:
            resp = session.get(paste_url, timeout=60)
            if resp.status_code == 200:
                content = resp.text.lower()
                for keyword in keywords:
                    if keyword.lower() in content:
                        results.append({
                            "url": paste_url,
                            "keyword": keyword,
                            "timestamp": datetime.utcnow().isoformat(),
                            "snippet": extract_context(content, keyword.lower()),
                        })
        except Exception as e:
            print(f"[-] Error fetching {paste_url}: {e}")

    return results


def extract_context(text, keyword, context_chars=200):
    """Extract text context around a keyword match."""
    idx = text.find(keyword)
    if idx == -1:
        return ""
    start = max(0, idx - context_chars)
    end = min(len(text), idx + len(keyword) + context_chars)
    return text[start:end]

Step 3: Monitor Ransomware Leak Sites

def check_ransomware_leak_sites(session, organization_name):
    """Check known ransomware group leak sites for organization mentions."""
    # Use Ransomwatch API (clearnet aggregator of ransomware leak sites)
    try:
        resp = requests.get(
            "https://raw.githubusercontent.com/joshhighet/ransomwatch/main/posts.json",
            timeout=30,
        )
        if resp.status_code == 200:
            posts = resp.json()
            matches = []
            for post in posts:
                post_title = post.get("post_title", "").lower()
                if organization_name.lower() in post_title:
                    matches.append({
                        "group": post.get("group_name", ""),
                        "title": post.get("post_title", ""),
                        "discovered": post.get("discovered", ""),
                        "url": post.get("post_url", ""),
                    })
            return matches
    except Exception as e:
        print(f"[-] Ransomwatch error: {e}")
    return []

Step 4: Generate Dark Web Intelligence Report

def generate_dark_web_report(findings, organization):
    """Generate structured dark web intelligence report."""
    report = {
        "organization": organization,
        "report_date": datetime.utcnow().isoformat(),
        "executive_summary": "",
        "credential_leaks": [],
        "ransomware_mentions": [],
        "dark_web_mentions": [],
        "recommendations": [],
    }

    for finding in findings:
        if finding.get("source") == "HIBP":
            report["credential_leaks"].append(finding)
        elif finding.get("group"):
            report["ransomware_mentions"].append(finding)
        else:
            report["dark_web_mentions"].append(finding)

    # Generate executive summary
    cred_count = len(report["credential_leaks"])
    ransom_count = len(report["ransomware_mentions"])
    report["executive_summary"] = (
        f"Monitoring identified {cred_count} credential leak sources "
        f"and {ransom_count} ransomware group mentions for {organization}."
    )

    if ransom_count > 0:
        report["recommendations"].append(
            "CRITICAL: Organization mentioned on ransomware leak site. "
            "Initiate incident response immediately."
        )
    if cred_count > 0:
        report["recommendations"].append(
            "HIGH: Leaked credentials detected. Force password resets for "
            "affected accounts and enable MFA."
        )

    return report

Validation Criteria

• Tor connection established and verified via check.torproject.org
• Credential leak monitoring returns results from HIBP and paste sites
• Ransomware leak site monitoring identifies relevant mentions
• Dark web intelligence report generated with actionable recommendations
• All monitoring performed within legal and ethical boundaries
• OPSEC maintained: no personal or corporate identity exposure

References

• Tor Project
• Have I Been Pwned API
• Ransomwatch
• DarkOwl
• Intel 471
• Flare Systems

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Dark Web Monitoring Intelligence Report

Report Metadata

Field	Value
Organization
Report Date	YYYY-MM-DD
Classification	TLP:AMBER
Monitoring Period	YYYY-MM-DD to YYYY-MM-DD

Executive Summary

[Brief overview of dark web findings]

Credential Leak Findings

Breach Name	Date	Accounts	Data Types	Domain

Ransomware Group Mentions

Group	Post Title	Date Discovered	Severity
			CRITICAL

Dark Web Mentions

Source	Context	Date	Severity

Recommendations

1. Immediate: [Critical actions required]
2. Short-term: [Actions within 48 hours]
3. Long-term: [Ongoing monitoring improvements]

references/api-reference.md (verbatim)

API Reference: Dark Web Threat Monitoring

Libraries Used

Library	Purpose
requests	HTTP client for Tor-proxied requests and clearnet APIs
json	Parse breach data and monitoring results
re	Pattern matching for credentials and brand mentions
hashlib	Hash credentials for safe lookup (k-anonymity)
datetime	Track monitoring timelines

Installation

pip install requests

# Tor service (required for .onion access)
# Ubuntu/Debian
sudo apt install tor
sudo systemctl start tor

# macOS
brew install tor && brew services start tor

Authentication and Proxy Configuration

Tor SOCKS5 Proxy Setup

import requests
import os

TOR_PROXY = os.environ.get("TOR_PROXY", "socks5h://127.0.0.1:9050")
proxies = {"http": TOR_PROXY, "https": TOR_PROXY}

def tor_request(url, timeout=30):
    """Make an HTTP request through the Tor network."""
    resp = requests.get(url, proxies=proxies, timeout=timeout)
    return resp

Verify Tor Connectivity

def check_tor_connection():
    try:
        resp = requests.get(
            "https://check.torproject.org/api/ip",
            proxies=proxies,
            timeout=15,
        )
        data = resp.json()
        return {"tor_active": data.get("IsTor", False), "exit_ip": data.get("IP")}
    except requests.RequestException as e:
        return {"tor_active": False, "error": str(e)}

Credential Breach Monitoring

Have I Been Pwned API (k-Anonymity)

import hashlib

HIBP_API = "https://api.pwnedpasswords.com/range/"

def check_password_breach(password):
    """Check if a password appears in known breaches using k-anonymity."""
    sha1 = hashlib.sha1(password.encode()).hexdigest().upper()
    prefix = sha1[:5]
    suffix = sha1[5:]

    resp = requests.get(f"{HIBP_API}{prefix}", timeout=10)
    resp.raise_for_status()

    for line in resp.text.splitlines():
        hash_suffix, count = line.split(":")
        if hash_suffix == suffix:
            return {"breached": True, "count": int(count)}
    return {"breached": False, "count": 0}

Check Email in Breaches

HIBP_ACCOUNT_API = "https://haveibeenpwned.com/api/v3/breachedaccount/"

def check_email_breaches(email, api_key):
    """Check if an email appears in known data breaches."""
    resp = requests.get(
        f"{HIBP_ACCOUNT_API}{email}",
        headers={
            "hibp-api-key": api_key,
            "user-agent": "SecurityAuditTool",
        },
        params={"truncateResponse": "false"},
        timeout=15,
    )
    if resp.status_code == 200:
        breaches = resp.json()
        return {
            "email": email,
            "breached": True,
            "breach_count": len(breaches),
            "breaches": [
                {
                    "name": b["Name"],
                    "date": b["BreachDate"],
                    "data_classes": b["DataClasses"],
                }
                for b in breaches
            ],
        }
    elif resp.status_code == 404:
        return {"email": email, "breached": False, "breach_count": 0}
    return {"email": email, "error": resp.status_code}

Brand Mention Monitoring

Search Paste Sites

def search_paste_sites(brand_keywords, api_key=None):
    """Search paste monitoring services for brand mentions."""
    findings = []
    for keyword in brand_keywords:
        # IntelligenceX API (example)
        resp = requests.get(
            "https://2.intelx.io/intelligent/search",
            headers={"x-key": api_key} if api_key else {},
            params={
                "term": keyword,
                "buckets": "pastes",
                "maxresults": 20,
                "datefrom": "",
                "dateto": "",
                "sort": 2,  # Date descending
            },
            timeout=30,
        )
        if resp.status_code == 200:
            results = resp.json().get("records", [])
            for r in results:
                findings.append({
                    "keyword": keyword,
                    "source": r.get("systemid"),
                    "date": r.get("date"),
                    "bucket": r.get("bucket"),
                })
    return findings

Domain Monitoring

Monitor for Credential Dumps Mentioning Domain

def monitor_domain_mentions(domain, sources):
    """Search for domain mentions across dark web sources."""
    findings = []
    email_pattern = re.compile(rf"[\w.+-]+@{re.escape(domain)}", re.IGNORECASE)

    for source in sources:
        try:
            resp = tor_request(source["url"], timeout=30)
            matches = email_pattern.findall(resp.text)
            if matches:
                findings.append({
                    "source": source["name"],
                    "emails_found": len(set(matches)),
                    "sample": list(set(matches))[:5],
                    "risk": "high",
                })
        except requests.RequestException:
            continue
    return findings

Alerting

def create_alert(finding, severity="high"):
    return {
        "alert_type": "dark_web_mention",
        "severity": severity,
        "source": finding.get("source"),
        "detail": finding,
        "timestamp": datetime.now().isoformat(),
        "action_required": "Investigate and rotate exposed credentials",
    }

Output Format

{
  "monitoring_date": "2025-01-15",
  "domain": "example.com",
  "tor_connected": true,
  "credential_breaches": {
    "emails_checked": 50,
    "breached_accounts": 8,
    "unique_breaches": 12
  },
  "paste_mentions": 3,
  "dark_web_findings": [
    {
      "source": "paste-site",
      "type": "credential_dump",
      "emails_found": 15,
      "risk": "high",
      "action": "Force password reset for affected accounts"
    }
  ]
}

references/standards.md (verbatim)

Standards and Frameworks Reference

Dark Web Intelligence Classification

• TLP:RED: Dark web source details, forum credentials, HUMINT methods
• TLP:AMBER: Specific threat actor mentions, leaked data analysis
• TLP:GREEN: Aggregated trends, anonymized statistics
• TLP:CLEAR: Public dark web monitoring advisories

MITRE ATT&CK Mapping

• T1589 - Gather Victim Identity Information (credential theft)
• T1590 - Gather Victim Network Information (reconnaissance)
• T1597 - Search Closed Sources (dark web forums)
• T1598 - Phishing for Information

Dark Web Source Categories

Category	Description	Examples
Forums	Discussion boards for cybercriminals	RaidForums successors, XSS.is, Exploit.in
Marketplaces	Buying/selling stolen data and tools	Various .onion markets
Paste Sites	Anonymous text sharing	Dark web paste services
Leak Sites	Ransomware data publication	LockBit, BlackCat, Royal blogs
Chat Channels	Real-time communication	Telegram groups, Discord

Legal and Ethical Framework

• Passive observation of publicly accessible dark web content is legal in most jurisdictions
• Active engagement (posting, purchasing) requires legal authorization
• Credential harvesting for defensive purposes requires clear policy
• Evidence collection must follow chain of custody procedures

References

• FIRST Traffic Light Protocol
• MITRE ATT&CK Reconnaissance
• Tor Project Documentation

references/workflows.md (verbatim)

Dark Web Monitoring Workflows

Workflow 1: Credential Leak Monitoring

[Organization Domains] --> [HIBP API Check] --> [Paste Site Monitoring] --> [Alert Generation]
                                                                                  |
                                                                                  v
                                                                        [Password Reset Enforcement]

Workflow 2: Brand Threat Monitoring

[Brand Keywords] --> [Dark Web Crawl] --> [Forum Monitoring] --> [Threat Assessment]
                                                                        |
                                                                        v
                                                                [Intel Report] --> [SOC Briefing]

Workflow 3: Ransomware Leak Monitoring

[Ransomwatch Feed] --> [Organization Match] --> [CRITICAL ALERT] --> [IR Activation]
                                                                          |
                                                                          v
                                                                  [Scope Assessment]

Workflow 4: Continuous Dark Web Intelligence

[Scheduled Scans] --> [Data Collection] --> [NLP Analysis] --> [Trend Analysis]
                                                                     |
                                                                     v
                                                            [Weekly Intelligence Brief]

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.