Darknet¶
The Darknet tab lists records from data leaks and darknet sources that refer to the organisation. It answers a different question from the rest of the platform: not what is exposed, but what has already been published.
Findings only appear here if at least one search term carries Darknet in its search scope. See Scope.
Depending on the configuration, Darknet displays either the Credential leaks and Raw sub-tabs or a single table of alerts. Use the section below that matches your view.
Credential leaks¶
The Credential leaks sub-tab shows structured records of leaked credentials. The following columns are visible by default:
| Column | Content |
|---|---|
| URL | The URL associated with the credential. |
| Email addresses in the record. | |
| Username | Usernames in the record. |
| Password | Password data available in the record. |
| Password Type | The recorded password type. |
| Password Hash | Available password hashes, with a copy button. |
| Origin | The source, with its discovery date and leak type where available. Linked source names open further details. |
Additional columns can be enabled through the column settings: Name, Company, Leak Time, IP Address, Social, Crypto Address, Licence Plate, Address, Phone, Database, Leak Type, and Raw Record. Cells containing multiple values can be expanded to show more entries.
Hiding duplicates¶
Hide duplicates is enabled by default and groups duplicate records. Switch it off to inspect the individual records, including duplicates. The interface remembers your choice.
Exporting credentials¶
Choose JSON or CSV from the table export. In Table export - Select view, choose Compact view to exclude duplicates or Complete view to include them, then select Start export. The export uses the current filters, sorting, and visible columns.
Raw¶
The Raw sub-tab shows matching source records. Select a domain from the Domain dropdown above the table to view its findings. Matches for the selected domain are highlighted in the raw text.
| Column | Content |
|---|---|
| Leak | The leak name, linked to its details. |
| File | The source's media and content type, with a link and button to download its content as a text file. |
| Date | The date recorded for the source. |
| Category | The category of the finding. |
| Raw | The matching source text. |
Use the column filters and sorting to narrow the results. JSON and CSV exports use the selected domain, current filters, sorting, and visible columns.
Alert table¶
If your Darknet view opens a single table of alerts, the following columns are visible by default:
| Column | Content |
|---|---|
| Name | The name of the leak or source. |
| Published on | When the data provider first identified and recorded the leak. This is not necessarily the date of the original exposure or publication. |
| Severity | The assessed exposure risk: Very high, High, Medium, Low, Very low, or None. |
| Affected data | The affected fields and their masked values, where available. |
| Password (Last characters) | The available final characters of the affected password. |
| Description | A description of the leak. |
| Recommendation | The recommended response. |
| Actions | Mark as seen or Mark as new for the record. |
Additional columns include Breach category, Alert ID, Alert flow, Description type, Source, Type, Creation date, and Status (Open or Done). Enable them through the column settings.
Showing only new records¶
The New entries only switch restricts the list to alerts that have not been marked as seen. New alerts are highlighted and have a marker beside their name.
After reviewing an alert, use Mark as seen in Actions. To update several alerts together, select their rows and choose Mark selected entries as seen. Use Mark as new on an individual alert to return it to the new entries list. Switching off New entries only shows both new and seen alerts.
Working through the findings¶
- Sort by Severity in descending order, or activate New entries only for a periodic review.
- Read Affected data and Description to understand the reported exposure.
- Use Password (Last characters), where available, to help recognise the affected credential.
- Apply the Recommendation, typically a password reset for the affected accounts.
- Where the same person appears repeatedly, check the corresponding record in Intel and consider stronger authentication for that account.
Exporting alerts¶
The table supports export to JSON or CSV using the current filters, sorting, and visible data columns. Row selection is used to mark alerts as seen; it does not restrict the export to the selected rows. See Working with the interface for the table controls and Exporting project data for project-wide exports.
Handling of leak data
Darknet findings may contain personal data and credentials. Restrict project access accordingly, export only what is needed, and treat downloaded files as confidential. The alert table displays masked affected values and password suffixes; the Credential leaks and Raw views may contain more detailed credential data.