Is it safe to browse the dark web using these tools?

The skill emphasizes strict OPSEC practices, such as using isolated VMs and routing all traffic through Tor. However, users must always follow legal, ethical, and corporate security guidelines.

Does this skill require a Tor connection?

Yes, this skill requires a running Tor instance or proxy (SOCKS5 on port 9050) to successfully access .onion domains and maintain anonymity during monitoring.

Which threat intelligence frameworks is this mapped to?

This skill is fully mapped to MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, and the NIST AI Risk Management Framework (RMF).

Can I use this for automated credential checking?

Yes, the skill includes Python scripts to monitor paste sites and the Have I Been Pwned API for organization-specific credential leaks.

Dark Web Threat Monitoring

Name: Dark Web Threat Monitoring
Author: mukul975

bymukul975

•

4,120

•

Seguridad y Pruebas

Monitors dark web forums, paste sites, and ransomware leak pages to detect organization-specific threats and leaked credentials.

This skill provides specialized guidance for establishing a dark web monitoring infrastructure within the Claude Code environment. It enables security analysts to programmatically scan Tor hidden services, underground forums, and marketplace listings for leaked credentials, brand mentions, and ransomware threats while maintaining rigorous operational security (OPSEC). By integrating with Tor-based proxies and threat intelligence APIs, the skill helps automate the collection and reporting of actionable intelligence from the internet's most hidden corners, mapped to NIST CSF and MITRE ATT&CK frameworks.

Características Principales

01Credential leak detection via HIBP and paste site monitoring

02Structured threat intelligence report generation

03Automated Tor-based HTTP session management

04Operational security (OPSEC) guidance for anonymous research

054,120 GitHub stars

06Real-time ransomware leak site tracking and analysis

Casos de Uso

01Automating threat intelligence collection from ransomware groups

02Pro-active brand protection and credential monitoring

03Performing security audits for organization-specific exposure on hidden services

Características Principales

01Credential leak detection via HIBP and paste site monitoring

02Structured threat intelligence report generation

03Automated Tor-based HTTP session management

04Operational security (OPSEC) guidance for anonymous research

054,120 GitHub stars

06Real-time ransomware leak site tracking and analysis

Casos de Uso

01Automating threat intelligence collection from ransomware groups

02Pro-active brand protection and credential monitoring

03Performing security audits for organization-specific exposure on hidden services