Dark web and exposure checks
What the dark web scan in every external assessment looks for, how to read "none found", and what it doesn't cover.
Updated
Every external assessment includes a dark web scan: checks for leaked credentials, ransomware leak-site listings, breached databases, secrets in public code, sensitive archived files and lookalike domains. It runs with passive assessments too, so it works for prospects.
Where to see it
- The assessment page's Dark web scan panel, and the customer's Attack surface.
- The executive, risk assessment and technical reports' Dark web and leak exposure table.
- Identity → Users (a Dark web column per Microsoft 365 user) and Customer settings → Contacts.
Click any area or source for a quick look: the area in plain language, each finding with the facts that matter (which group posted what and when, which repository and file, which archived files), the steps to fix it, and for each source what it checked and when, or exactly why it wasn't checked.
Areas
| Area | What it looks for |
|---|---|
| Employee credentials | Infostealer logs and breached accounts for the organisation's domains, where those sources are enabled for your workspace |
| Website visitor credentials | Credentials for the organisation's sign-in pages captured by infostealer malware on visitors' computers, where enabled |
| Ransomware leak sites | Whether a ransomware group lists the organisation as a victim. Critical when the domain is named and the post is under a year old |
| Breaches and leaked databases | Whether the organisation's own service is a known breach source, or its database is traded |
| Public code repositories | Public GitHub code, issues and pull requests that mention the domain. Suspected passwords, keys and tokens are flagged (high, suspected) with the value redacted; everything else is one informational "mentioned in N files" finding |
| Archived files and documents | Backups, database dumps, keys, configuration files and sensitively named documents the Internet Archive captured on the organisation's sites. File names only: contents are never downloaded |
| Lookalike domains | Registered typos and variants of the domain with mail servers, not on the organisation's own name or mail servers. Medium if registered in the last six months |
| Mailboxes | The customer's contacts checked against breach sources enabled for your workspace |
Code-search results are re-checked for the exact domain, and long domain lists (blocklists, rankings, expired-domain dumps) are discarded. That's why the count is usually far lower than a free scanner's "signals".
Reading the results
- "None found" means no matches in the sources checked. It never means no exposure exists.
- A source that failed, was rate-limited or isn't enabled is labelled as such, never shown as clean.
- Credentials are never tested against any service, and no passwords are stored. Code fragments are redacted before they're stored, shown to the AI analyst or put in reports, and email addresses are masked.
- Dark web findings aren't auto-resolved by a later clean lookup, because leaked data stays leaked. Close them in the triage workflow once handled: reset the passwords, revoke the keys, remove the files.
- Historical exposure isn't proof of a current compromise.
What to do
| Finding | First steps |
|---|---|
| Ransomware leak-site listing | Treat as an incident: confirm with the customer, engage their incident response and insurer, preserve evidence |
| Infostealer credentials | Reset the affected accounts' passwords and sessions, require MFA, check the infected computer for malware |
| Secret in public code | Revoke and rotate the key or token, remove it from the repository history, check its use since the commit |
| Archived sensitive file | Remove the file from the website, rotate anything it contained, ask the archive to exclude it |
| Lookalike domain with mail | Watch for phishing that uses it, add it to mail filtering, consider a takedown request |
Not covered
- Forums, marketplaces and Telegram channels are not monitored.
- RevoSecure doesn't confirm phishing: a lookalike domain is a candidate to watch, not proof of a phishing site.
- Which credential sources run depends on what's enabled for your workspace; each source's status is shown in the panel.