Credential leak detection
Corporate credentials appearing in breach dumps, stealer logs and criminal marketplaces are identified and mapped back to accounts.
Surface
Detectexposure,chatterandthreatsbeforetheyreachtheopenweb
Continuous monitoring of dark web markets, forums, leak sites and credential dumps for mentions of your brand, assets and people.
The dark web is where stolen credentials, leaked data and attack planning surface first. By the time a breach reaches the open web or the press, the damage is done. Our dark web intelligence service monitors criminal infrastructure continuously for early indicators that your organisation is being targeted or has already been exposed.
We track markets, forums, leak sites, paste sites and Telegram channels for mentions of your domains, email addresses, executive names, IP ranges and sensitive data. Every alert is analysed by a human to confirm whether it is a genuine exposure or noise.
Capabilities
What's included in Dark Web Intelligence
Everything below is delivered and tracked through the Mirage Portal.
Brand and executive monitoring
Mentions of your brand, domains, executive names and sensitive assets across forums and chat channels.
Data leak tracking
Detection of databases, source code, documents and credentials offered for sale or published on leak sites.
Threat actor chatter
Early warning when your organisation is discussed as a target, including access broker listings and ransomware affiliate claims.
Human triage
Every potential hit is reviewed by an analyst to confirm authenticity, severity and recommended action.
Rapid alerting
Critical findings are escalated immediately with evidence and remediation guidance, not just a list of keywords.
Coverage
Scope and depth
Sources monitored
- Dark web marketplaces and forums
- Ransomware and data leak sites
- Paste sites and anonymous publishing
- Encrypted chat channels
- Breach corpora and stealer logs
- Access broker listings
What we look for
- Corporate credentials and email addresses
- Domain and brand mentions
- Executive and employee targeting
- Source code and document leaks
- Database dumps and customer records
- Initial access offers and chatter
How it works
Our delivery process
A consistent, transparent methodology from first conversation to verified remediation.
- 01
Scope
We agree the brands, domains, email patterns, executive names and assets to monitor.
- 02
Baseline
An initial sweep identifies historical exposure and establishes a starting risk picture.
- 03
Monitor
Continuous automated and human-led monitoring of criminal sources runs around the clock.
- 04
Triage
Potential hits are verified, false positives discarded and genuine findings risk-rated.
- 05
Respond
You receive alerts with evidence, recommended actions and support for credential resets or takedowns.
What you receive
- Dark web exposure dashboard in the Mirage Portal
- Verified credential and data-leak alerts
- Weekly intelligence summaries
- Incident response support for confirmed leaks
- Executive briefing on dark web risk posture
Business outcomes
- Faster detection of credential and data exposure
- Earlier warning of targeted attack planning
- Reduced mean time to respond to leaked credentials
- Evidence for incident response, insurers and regulators
FAQs
Common questions
How quickly are leaks detected?
Monitoring runs continuously. Critical findings are escalated within hours of being identified and verified.
Can you take down leaked data?
We provide evidence and guidance for takedown requests, working with your legal and incident response teams where appropriate.
Do we need to give you credentials?
No. We monitor for public and criminal-source exposure using identifiers you authorise, such as domains and email patterns.
More services
Explore the rest of our portfolio
Save time and book a call with us
Enterprise-grade penetration testing, built around your business
CREST-registered testing delivered through a flexible PTaaS model — designed to fit your environment, risk profile and internal teams.