Dark web monitoring: what it sees, and what it misses

What is dark web monitoring?

Dark web monitoring means having a service search, for you, places you cannot easily search yourself, and warn you when your company appears there: its name, its domain, its staff’s e-mail addresses or its documents.

The term is wider than the dark web itself. It usually covers three kinds of place:

• Ransomware group sites. A group names the company it attacked on its own site and, if the company does not pay, publishes the files it took. Many of these sites can only be reached through Tor, a network that hides where you connect from.
• Criminal forums and markets. Where data, access to company networks and accounts are offered or traded.
• Messaging channels such as Telegram. Not the dark web strictly speaking, since the app is open to anyone, but a place where compromised credentials are often shared.

What can it find?

1. Documents that ransomware groups published. Yours, or a supplier’s in which you appear: a contract, an invoice, a spreadsheet or a mailbox that carries your name or domain. Work out what it exposes, tell your data protection officer, and change the passwords and keys it reveals.
2. Compromised credentials. E-mail addresses and passwords put into circulation in lists, often after a data breach at another service. A finding is an address on your domain next to a password, with a source and a date. Reset the password, end open sessions, turn on a second factor, and check where else the password is used.
3. Mentions and sale offers on forums. A post that names your company or offers access to its network or data. A finding is a title, a date, a seller’s handle and a few lines. Treat it as a lead, not a fact: sellers exaggerate and some invent. Have it checked before you act.

What can it not see?

• Private sales and closed groups. Data sold in private messages or invite-only groups never reaches the places a service can read.
• Data not published yet. An attacker can hold your files for weeks before posting anything. Monitoring sees the posting, not the intrusion.
• Anything inside your own systems. A compromised laptop or an exposed storage space is invisible from outside. That is the job of your own security tools.
• Whatever the service has not indexed. Coverage always depends on the sources a service has chosen and managed to read.

It does not prevent an attack either: it tells you, after the fact, that something is out there. Its value is time.

Search, scan, monitoring: what is the difference?

• A search is a question you ask yourself, once: does my domain appear? You get the answer now, and nothing watches afterwards.
• A scan is what providers often call a free first check: you give a domain and get a short report. It is a test, not a watch.
• Monitoring runs continuously: the service reads new material as it is published and alerts you. Only it tells you about something new after you stopped looking.

A second difference is what gets searched. Some services list the companies that ransomware groups claim as victims: that tells you who was named, not what was published. Others index the published files themselves, in full text, so a search can find your name inside a supplier’s contract. Only the second can show that you appear in someone else’s incident.

What does a clean result mean?

Not that you are safe: this service, looking at these sources, found nothing today.

An empty result is not proof of absence. A name can be spelled another way, a document can be missing from the index, a group can publish later, and data can circulate where the service does not look.

Look again after an incident at a supplier or partner, after a change of name, domain or owner, and at a regular rhythm, monthly for example, if you rely on one-off searches.

Does a small or mid-size company need it?

Not always. It deserves a serious look if one of these is true:

• You hold your customers’ documents or personal data.
• You depend on a few suppliers whose incident would expose you.
• You supply large groups, who may ask how you would learn that you were exposed.
• You are in scope of rules on supply chain security. NIS2 and DORA deal with the security of suppliers and ICT providers for the organisations in their scope, and AirCyber assesses aerospace suppliers. This is general context, not a claim that any of them calls for dark web monitoring; your own advisers can say whether you are in scope.

If none of these applies, a free search now and then may be enough.

What should you ask a provider?

1. Which sources? Ransomware sites, forums, markets, messaging channels: which ones, and how it chooses them.
2. Names or contents? A list of claimed victims, or the published files themselves, searchable in full text?
3. How fresh? How long after a posting does it appear?
4. What do you see about third parties? The other companies and people in the same files: what shows, what stays hidden.
5. What does it cost? A public price or a quote?
6. Can your own tools or AI read the data? Through an API or a connector, or only on a dashboard?
7. What happens to your searches? Who sees what you look for, and for how long.
8. What does it say it cannot do? A provider that states its limits is easier to trust.

Where does OwlyScan fit?

OwlyScan is a search engine over the files ransomware groups published. Its index holds what was published on ransomware sites and forums, not everything that exists: it sees nothing of private sales, unpublished data or your own systems.

• The free search needs no account and can be run a few times a day. It shows how many documents match your company name or domain, and of what kind, with names hidden; you do not read their text. How it works.
• Access is a subscription for your own company. It shows the records about your own domain as they are, keeps other companies’ names hidden, and connects your AI assistant to the same data through MCP, a standard way to link an assistant to a data source. Results are excerpts, not whole documents; alerts are part of Unlimited. The price is public: €39 a month or €390 a year, excl. VAT. Pricing.
• Unlimited, on quote: alerts and reports, field filters, export, opening full documents.
• Ecosystem, on quote: continuous follow-up of your company and the companies you depend on, your suppliers for example, on one dashboard.

Try your own domain with the free search or the dark web check. If a supplier was hit, read what to do when your supplier is hit by ransomware.

Questions people ask