Last week, application security company ImmuniWeb released a new free tool to monitor and measure an organization's exposure on the Dark Web.

To improve the decision-making process for cybersecurity professionals, the free tool crawls Dark Web marketplaces, hacking forums, and Surface Web resources such as Pastebin or GitHub to provide you with a classified schema of your data being offered for sale or leaked.

All you need to launch a Dark Web search is to enter your domain name.

The volume of stolen credentials on the Dark Web is booming

This week, over 26 million user records, including plaintext passwords, stolen from LiveJournal appeared on a Dark Web marketplace for as low as $35. The present week is likewise sadly marked with a compromise of 31 SQL databases (with 1.6 million rows of client data) from webshop owners.

There were 7,098 breaches reported in 2019, exposing over 15.1 billion records, a new worst year on record according to Risk Based Security report. Over 80% of data breaches within the hacking category involve usage of lost or stolen credentials, says the Data Breach Investigations Report 2020 by Verizon.

While over 21 million of stolen login credentials from Fortune 500 companies were readily available for sale in the Dark Web, according to ImmuniWeb report from 2019.

ImmuniWeb Dark Web monitoring tool in action

ImmuniWeb says that its Deep Learning AI technology is capable of distinguishing and removing duplicates and fake records, providing actionable and risk-scored data to its clients.

Here is an example of findings for a well-known financial institution:


Interestingly, for Gartner, there are over 100,000 mentions of detected login credentials and other data. However only 14% pass the AI-enabled validation, and as low as 466 were assigned a critical risk, potentially exposing apparently valid passwords from business-critical web resources:


In its press release, ImmuniWeb also mentions that on top visibility across 30 billion of stolen credentials, the free online test likewise detects and provides full technical details:

• Phishing Campaigns
• Domain Squatting
• Trademark Infringement
• Fake Social Networks Accounts

For example, for Yahoo, 131 ongoing phishing campaigns are targeting its clients, over 1,000 cybersquatted or typosquatted domains, many of which redirect to malware and ransomware doorways.

The hyperlinks to the malicious websites are displayed in a safe manner, with each entry also equipped with a screenshot to enable security professionals to assess the risk without the need to open dangerous web resources in their browser.

The tool is also available via a free API, making it an invaluable instrument for SOC security analysts to timely spot security emerging web security and privacy threats.

Last time we mentioned ImmuniWeb was among Top 10 Most Innovative Cybersecurity Companies after RSA 2020, and it seems that while successfully pursuing its growth track, their team doesn't forget to contribute to the cybersecurity community. Good work!