What We Monitor and What We Don't

Learn exactly what Breachsense monitors so you can map your coverage gaps.

Knowing what a tool does is useful. Knowing what it doesn’t do is just as important.

Security teams need to map coverage gaps. You can’t do that if your vendor only talks about what they cover.

This page lays out both sides. What Breachsense monitors and what it doesn’t.

Below, you’ll find every source type we cover, every data type we index, and what falls outside our scope.

What Dark Web Sources Does Breachsense Monitor?

Your credentials could be for sale right now. You’d never know unless someone’s watching the right places.

Here’s every source type Breachsense covers.

Dark web marketplaces. Tor hidden services and .onion sites where criminals buy and sell stolen data. Our crawlers watch active markets around the clock.

Criminal forums. Both public and private hacker forums. Many breaches surface on forums before they hit the news.

Ransomware leak sites. We track over 100 ransomware groups and their leak sites. Ransomware remains one of CISA’s top tracked threats. When a gang posts a new victim, we pick it up fast.

Infostealer channels. We index logs from credential-stealing malware like RedLine and LummaC2 as they appear on infostealer channels. This source is growing faster than any other.

Telegram and IRC channels. Criminal groups distribute stealer logs and sell network access through private channels. These often carry early breach signals.

Paste sites. Pastebin and similar sites are common drop points for leaked credentials and data samples.

Exposed databases. We catch and index misconfigured Elasticsearch and MongoDB servers that leak sensitive data.

What Data Gets Indexed?

Sources are only half the picture. Here’s what we actually extract and make searchable.

Compromised credentials. Emails and passwords from data breaches and stealer logs. The Verizon 2025 DBIR found stolen credentials in 88% of basic web application breaches. We crack hashed passwords to plaintext so you know exactly what’s exposed. The database holds over 343 billion compromised credentials.

Session tokens and cookies. Active authentication tokens from infostealer logs. Attackers use these to bypass passwords and MFA entirely. These alerts are time-sensitive because tokens expire.

Leaked files from ransomware attacks. We index stolen files published by ransomware groups with full-text search. You can search for your company name or employee names across millions of leaked documents.

Ransomware victim announcements. Every time a ransomware gang posts a new victim, we capture it. You can monitor for your own company or for vendors in your supply chain.

Threat actor chatter. We track hacker forums and Telegram channels where attackers sell network access or advertise compromised companies. If someone’s selling a way into your network, you’ll know.

Combo lists. Credential stuffing lists traded among attackers. These contain email and password pairs aggregated from multiple breaches.

What Does Attack Surface Monitoring Cover?

Beyond dark web intelligence, Breachsense monitors your external attack surface for threats that start elsewhere.

Subdomain discovery. We map all subdomains tied to your domain automatically. Forgotten infrastructure and shadow IT get flagged early.

Phishing domain detection. We detect lookalike domains impersonating your brand through continuous scanning. That includes homoglyph and typosquatting domains. We also catch alternative TLD registrations. Learn more about external attack surface management.

Certificate Transparency log monitoring. We watch for SSL certificates issued to suspicious lookalike domains. This catches phishing infrastructure early, often before the site goes live.

Takedown services. When we detect a malicious domain targeting your brand, we can initiate a takedown to get it removed.

How Do Alerts and Integration Work?

None of this matters if you don’t find out fast. Here’s how Breachsense delivers alerts.

Email alerts. Get notified the moment your data appears in any monitored source.

Webhook alerts. Push alerts directly to your SIEM or ticketing system. This is the fastest path from detection to response.

REST API. Query historical data on demand through the Breachsense API. Search by email or domain.

Executive monitoring. You can monitor personal email addresses for C-level executives separately. If a CEO’s credentials show up in a stealer log, you’ll know immediately.

What Does Breachsense NOT Monitor?

Every tool has boundaries. Here’s what we don’t cover.

Code repositories. We don’t scan GitHub or GitLab for leaked secrets or API keys. Our focus is dark web sources and leaked credentials, not source code.

Social media accounts. We catch fake domains targeting your brand, but we don’t monitor for fake LinkedIn or Twitter profiles.

Brand reputation on social media. Dark web monitoring tracks stolen data, not social sentiment. Brand monitoring tools handle that.

Trademark enforcement. We detect phishing domains automatically. But legal action and trademark enforcement are on you. We find the threat; you handle the legal side.

Deepfake detection. Voice cloning and video impersonation aren’t part of what we monitor.

Endpoint detection and XDR. Breachsense doesn’t run agents on your endpoints. We find the leaked passwords that come from infected endpoints, but we don’t detect the infection itself.

Fraud detection. Device fingerprinting and behavioral biometrics aren’t something we do.

Network traffic analysis. We don’t inspect your network traffic or act as an IDS/IPS.

Vulnerability scanning. We don’t scan your infrastructure for CVEs. We monitor for credentials and data that have already been stolen.

Email security. Spam filtering and email gateway protection are separate from what we do.

How Should You Use This Page?

Use this when you’re evaluating Breachsense or documenting your tooling coverage.

Vendor evaluation. Compare what we monitor against your requirements. If you need code repository scanning, you know that’s a gap you’ll fill elsewhere.

Coverage mapping. Use the “what we don’t monitor” list to identify where you need additional tools. No single vendor covers everything.

Compliance documentation. If auditors ask what your dark web monitoring methodology covers, point them here.

Risk modeling. Knowing our blind spots helps you build an accurate risk model. We’re transparent about what we can and can’t see.

Conclusion

Breachsense monitors dark web marketplaces and hacker forums. We also cover ransomware leak sites and infostealer channels. We index leaked credentials and session tokens, and we offer full-text search across files from ransomware attacks. Your external attack surface gets monitored too.

We don’t cover code repos or social media. Endpoints and network traffic need other tools.

We publish this page because your security decisions depend on knowing exactly what your tools cover. If you want to see what’s already exposed, start with a dark web scan. For continuous monitoring, see Breachsense dark web monitoring.