# Dark Web Mentions Monitoring URL: https://www.deepinfo.com/platform/cti/dark-web-mentions-monitoring/ ## See Your Organization’s Name Where Attackers Talk. Dark Web Mentions Monitoring is the always-on half of dark web coverage. It keeps reading Deepinfo’s dark web index for your domains, brands and people. Each mention comes with its source, its crawl date and the text around the match. [Request demo](https://www.deepinfo.com/request-demo/) Nobody searches for a mention *they don’t expect.* On-demand search is only as good as the question an analyst thinks to ask. The mentions that matter tend to be the unexpected ones: access to your network offered for sale, a supplier’s files on a leak site, a thread pairing your domain with a fresh CVE. Mentions Monitoring keeps that question open, so the answer does not depend on someone remembering to ask it. ### The Names Worth Watching. A mention is a page in a dark web source that names something of yours. These are the names that point back to your organization. Infrastructure #### Domains and Email Domains Your registered domains and the domains your staff send mail from. A post that lists addresses on them usually means a leak somewhere. Brands #### Organization and Product Names The names your organization, its brands and its products go by, as they appear in thread titles, listings and leak announcements. People #### Executives and Administrators The people whose names attract targeting: leadership, and the administrators who hold privileged access. ### What a Mention Carries With It. Mentions come from the dark web index that Dark Web Search queries, so each one carries the fields the index keeps for a page. - **Source**: The page title, URL and source domain, typed as forum, market, paste, leak, chat or IRC - **Date**: When the page was crawled - **Context**: A snippet of the surrounding text, so the match can be read where it sits - **Indicators**: Email addresses, IPs, crypto addresses, CVE IDs and websites extracted from that page - **Sensitive data**: Card numbers and Social Security numbers found on the page, where present - **Signal**: A hackishness score between 0 and 1 for the page Fields as documented for the dark web index in the [Darkweb Search reference](https://docs.deepinfo.com/reference/darkweb/search/). ### Which Mentions to Act on First. A name on a forum is not an incident. These patterns usually are, and each one has a workflow to hand it to. #### [Addresses on Your Domain in a Leak](https://www.deepinfo.com/platform/cti/employee-email-breach-monitoring/) A paste or leak that lists addresses on your email domain is a credential problem before it is anything else. #### [Access or Data Offered for Sale](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/) A market listing that names your organization. Treat it as a possible intrusion until the evidence says otherwise. #### [Card Numbers Next to Your Brand](https://www.deepinfo.com/platform/cti/compromised-payment-credential-monitoring/) Payment data posted alongside your name can point to a compromise somewhere in your payment path. Check the cards against your payment credential records. #### [A CVE Next to Your Domain](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/) A thread that pairs a vulnerability with your infrastructure. Check whether that CVE is present on your assets. #### [Your People, by Name](https://www.deepinfo.com/platform/cti/executive-threat-monitoring/) Executives and administrators named in threat context need their own review. ### Where a Mention Leads Next. - [Dark Web Search](https://www.deepinfo.com/platform/cti/dark-web-search/) (CTI): The on-demand counterpart: query the same index by phrase or indicator. - [Threat Actor Intelligence](https://www.deepinfo.com/platform/cti/threat-actor-intelligence/) (CTI): Actor profiles with the leak names, forums and markets each one is active on. - [Executive Threat Monitoring](https://www.deepinfo.com/platform/cti/executive-threat-monitoring/) (CTI): Dedicated attention for the people most likely to be named. ### Query This Data Through the API Credentials and dark web findings stay in the Deepinfo Platform. The domain and vulnerability data around them is open through the API. - [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/) - [Vulnerability Detail API](https://www.deepinfo.com/data-api/apis/vulnerability-detail/) - [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/) - [WHOIS History API](https://www.deepinfo.com/data-api/apis/whois-history/) ### Questions About Dark Web Mentions Monitoring **What counts as a dark web mention?** A page in a dark web source that contains one of your identifiers: a forum post, a market listing, a paste or a leak site entry. The identifier can appear as plain text or as a value the index extracts, such as an email address on your domain. **How is it different from Dark Web Search?** Search runs when an analyst asks a question. Mentions Monitoring keeps the question open for your identifiers. Both read the same index, so the other indicators on a mentioned page can be followed up with a search. **Which sources does it read?** Forums, markets, paste sites, chats and leak sites, as indexed by Deepinfo. Each mention is typed by the kind of source it came from. **How do we tell an old dump from a new post?** A mention’s crawl date shows when Deepinfo read the page, not when it was posted. Run a [Dark Web Search](https://www.deepinfo.com/platform/cti/dark-web-search/) on the same identifier and filter on the post date to separate new posts from an old dump that has resurfaced. **Does no mention mean nobody is talking about us?** It means nothing was found in the sources Deepinfo indexes. Dark web coverage is partial by nature, as the [methodology](https://www.deepinfo.com/methodology/#limitations) states. ### See Where Your Name Already Comes Up. Book a demo and bring your domains and brand names. We’ll walk your team through how mentions of them are found, read and triaged. [Request demo](https://www.deepinfo.com/request-demo/)