How to Track Brand Mentions on Dark Web Forums

Introduction

When the now-defunct BreachForums hosted terabytes of stolen credentials, many organizations only discovered their brands were being discussed, impersonated, or targeted after the data was already weaponized. A single post on Exploit.in or XSS.is—advertising "VIP access" to your company’s VPN or selling a zero-day exploit that affects your software—can cost millions in remediation, legal fees, and reputational damage. Learning how to track brand mentions on dark web forums is no longer a luxury; it is a fundamental security intelligence capability for protecting enterprise value in an era where initial access brokers (IABs) monetize corporate identities daily.

This guide is written for security operations teams, threat intelligence analysts, and brand protection managers who need to go beyond simple keyword alerts. You will learn the specific techniques, tools, and workflows required to identify, monitor, and respond to brand mentions across Tor hidden services, Telegram channels, and invite-only criminal forums. We answer the question: how do you turn a noisy firehose of dark web chatter into actionable intelligence that protects your brand before it gets sold to the highest bidder.

Why Brand Mention Tracking on Dark Web Forums Matters

Brand mentions on dark web forums are not idle conversation. They are market signals. When a threat actor mentions your brand by name, they are either evaluating your organization as a target, seeking resale value for stolen access, or recruiting co-conspirators for a ransomware deployment. According to the SpyCloud Annual Identity Exposure Report 2024, 75% of compromised credentials exposed on the dark web come from infostealer malware—malware that specifically targets credentials for corporate applications bearing well-known brand names. Failing to track brand mentions means missing the earliest warning signs of an attack chain.

The IBM Cost of a Data Breach Report 2024 found that organizations with security AI and automation—including dark web monitoring—identified breaches 108 days faster than those without. Brand mention tracking is the earliest trigger in that identification process.

What Kinds of Brand Mentions Should You Track?

You should track three distinct categories: direct mentions of your company name, references to your domain names and IP ranges, and discussions of your software or hardware products. Direct mentions often appear in credential dumps, phishing kit advertisements, and access-for-sale posts. Domain and IP references surface on IAB forums where actors list "shell access" to a specific hosting environment. Product mentions appear on exploit marketplaces like Russian Market, where actors sell zero-day vulnerabilities against your software.

• Corporate Entity Mentions: Company name, registered trademarks, CEO name, well-known subsidiary names. These are the most basic signals but require deduplication against false positives (e.g., shared names across industries).
• Digital Asset References: Primary domain, subdomains (vpn.company.com, sso.company.com), IP ranges, ASN numbers. IABs list these directly in "access for sale" posts.
• Product and Service Mentions: Product SKUs, version-specific names, API endpoint patterns. Threat actors search for these when looking for exploitable technology stacks.

Understanding the Dark Web Forum Landscape

Not all dark web forums are created equal. Brand mention tracking effectiveness depends heavily on knowing which forums are active, which specialize in which types of data, and how access to them is controlled. The landscape has evolved significantly since the FBI takedown of RaidForums in 2022 and the subsequent collapse of BreachForums in 2023. Newer forums have emerged with stricter vetting, making automated access more challenging but the intelligence gathered more valuable.

For brand mention tracking, you need to monitor at least four categories of forums: general criminal markets, IAB-specific marketplaces, ransomware leak sites, and stealer log repositories. Each category surfaces different types of brand signals. XSS.is and Exploit.in remain the most active general forums for English-speaking threat actors. RAMP is the primary successor to BreachForums for Russian-language actors. Telegram channels operated by groups like Scattered Spider (UNC3944) have become increasingly important for real-time coordination on brand-targeting attacks.

A 2024 Mandiant M-Trends report noted that 60% of all initial access compromises tracked by Mandiant involved an IAB selling VPN or RDP access on dark web forums. Brand mention tracking is the primary method for identifying when your organization's access is listed on these forums.

Which Forums Pose the Highest Risk to Brands?

The highest-risk forums are those that require a paid membership or an existing criminal reputation to access. These closed forums, such as the more exclusive sections of Exploit.in and certain Russian-language Telegram groups, are where high-value access is traded. Because they are harder to monitor passively, they present the greatest blind spot for organizations relying on free or basic monitoring tools. A brand mention on a closed forum signals a mature targeting operation that is likely further down the attack chain.

• Exploit.in: English-language, requires an application with references from existing members. High-quality access and large-scale credential dumps.
• XSS.is: Similar to Exploit.in but with a focus on web application exploits. Very high signal-to-noise ratio for brand mentions.
• RAMP: Russian-language, successor to BreachForums. Strongly correlated with ransomware groups, including LockBit affiliates.
• Russian Market: Automated stealer log marketplace. Brand mentions appear as login URLs captured by RedLine, Vidar, and other stealers.

How to Track Brand Mentions on Dark Web Forums: Step-by-Step

1. Step 1: Define Your Brand Asset Inventory and Monitor Keywords

   Before you search any dark web forum, you must build a comprehensive inventory of brand assets that could be mentioned by threat actors. This inventory goes beyond your primary domain name. Include all subsidiaries, joint ventures, product lines, API endpoints, email domains used for corporate logins, and the name of your C-suite executives (phishing kits often target executives by name). Create keyword groups with boolean operators: your company name, domain, common misspellings, and related domains (company-support.com, company-verify.com are common phishing domain patterns).

   For example, if your company is "Acme Corp," your keyword set should include "Acme Corp," "acmecorp," "acme-corp," "acme.vpn," "acme.sso," "acme-verify," and the names of your HR and IT executives. Tools like Python scripts for Levenshtein distance matching can help catch intentional misspellings used by threat actors to evade basic keyword filtering.

2. Step 2: Establish Access to Tor Hidden Services and Telegram Channels

   Direct access to dark web forums requires the Tor Browser for .onion sites and a monitored Telegram account for private channels. For Tor access, configure your Tor Browser with privacy hardening: disable JavaScript, set security level to "Safest," and use a dedicated SOCKS5 proxy if you are integrating with an automated collection tool. For Telegram, create a dedicated account using a virtual number; do not use your personal or corporate phone number. Join public groups related to the forums you want to monitor, as many forums cross-post content to Telegram channels for broader distribution. This step is purely observational; do not interact with posts or engage with forum members.

   Organizations without dedicated threat intelligence teams should consider that manual access maintenance is resource-intensive and carries operational risk. Many security teams prefer to deploy automated collectors via headless browser frameworks (like Selenium with Tor) that scrape specific forum sections on a schedule, but this requires ongoing maintenance as forums change their anti-bot protections.

3. Step 3: Deploy Passive Collection via Forum Scraping and RSS Monitoring

   Passive collection is the backbone of brand mention tracking. For public or semi-public sections of forums (e.g., general discussion, carding shops, some marketplace listings), you can deploy automated scraping tools that periodically check for new posts containing your keywords. Use a scraper that rotates Tor circuits to avoid IP-based banning. Parse the raw HTML of each forum page for your keyword list, and store matched posts in a database with metadata: forum name, post author, date, thread context, and a snapshot of the post content. For forums that offer RSS feeds (some still do), RSS polling is a lighter-touch alternative that many forums tolerate.

   The key challenge here is volume. A scraper targeting five major forums for a single brand will generate hundreds of posts per week. You will need a classification step (either human review or ML-based) to distinguish between legitimate discussion (e.g., a security researcher mentioning your tool) and malicious mentions (e.g., an IAB selling admin credentials to your SharePoint).

4. Step 4: Active Monitoring in Private and Invite-Only Forum Sections

   Private forum sections—such as the "Access Market" or "Exploit Exchange" areas of Exploit.in—require active monitoring. You cannot scrape these sections without an authenticated forum account. If your organization has the risk appetite and legal clearance, you can maintain a small number of undercover accounts to monitor these sections. Active monitoring involves periodically logging in (again, via Tor), navigating to relevant subforums, and manually reviewing new posts. This is time-intensive and should be reserved for high-priority brand terms. Some threat intelligence platforms, including DarkThreat.AI, maintain automated access to these sections through established relationships and automated credential rotation, removing the manual burden from your team.

   When conducting active monitoring, never download files from the forum, never click links, and never respond to posts. The goal is observation only. Document each brand mention with a screenshot and a timeline of when it appeared. This creates an audit trail that can be used for incident response, law enforcement referrals, or legal trademark enforcement actions.

5. Step 5: Correlate Brand Mentions with Stealer Logs and Leak Repositories

   Brand mentions on forums are often the visible tip of an iceberg whose hidden mass is in stealer log repositories like Russian Market, Genesis Market (now defunct but its successors exist), and private Telegram bots that aggregate logs from RedLine, Vidar, and Raccoon stealers. A brand mention on Exploit.in that references "Acme Corp VPN access" should trigger an immediate search of known stealer log databases for any credentials matching your corporate domain. The correlation between a forum post and a stealer log entry is the true signal: it confirms that the threat actor's claim is credible and that your organization has an active credential exposure.

   This correlation step is where most manual tracking efforts fail because stealer log databases are vast and unstructured. A single RedLine stealer log can contain thousands of entries for dozens of brands. Machine-learning-based deduplication and priority scoring—such as sorting logs by "last seen active" or "domain match confidence"—is essential to turn this step from a search exercise into a detection workflow.

6. Step 6: Escalate and Respond Based on Severity Classification

   Not all brand mentions warrant the same response. Classify each mention into a severity tier: Critical (active sale of access or credentials with proven access), High (mention of your brand in an IAB context without confirmed access), Medium (brand appears in a credential dump or stealer log without active sale), and Low (general discussion or researcher mention). For Critical and High mentions, your incident response team should immediately validate the claim (e.g., check if the VPN credentials actually work), rotate affected credentials, enable MFA on all accounts in the affected scope, and consider whether to engage law enforcement. For Medium mentions, prioritize rotating the identified credentials and monitoring for further targeting. For Low mentions, log and archive.

   Document every escalation in a dark web incident register. This register becomes critical evidence for compliance frameworks like SOC 2 (where dark web monitoring can serve as a compensating control for access management) and for demonstrating due diligence in SEC cybersecurity incident disclosure filings.

Tools and Approaches for Brand Mention Monitoring

The tools available for brand mention tracking range from manual open-source intelligence (OSINT) frameworks to fully automated commercial threat intelligence platforms. Each approach has trade-offs in coverage, freshness, and operational overhead.

What Is the Difference Between Keyword Monitoring and Contextual Brand Analysis?

Keyword monitoring flags any post containing your brand term, regardless of context. Contextual brand analysis uses natural language processing (NLP) and threat actor profiles to determine whether the mention is malicious, neutral, or benign. For example, a post saying "I like Acme Corp's security whitepapers" is a benign mention; a post saying "selling RDP to Acme Corp, verified domain control" is an active threat. Moving from keyword monitoring to contextual analysis is the key shift that turns brand mention tracking from a noisy data feed into a prioritized intelligence product. Most modern commercial platforms offer some degree of contextual classification, while manual tracking requires an analyst to perform this triage.

How DarkThreat.AI Approaches Brand Mention Tracking

DarkThreat.AI approaches brand mention tracking by combining automated collection across the full spectrum of dark web sources—Tor hidden services, Telegram channels, invite-only forums, and stealer log repositories—with a machine-learning classification engine that separates malicious mentions from background noise. Rather than requiring your team to maintain undercover forum accounts or build custom scraping infrastructure, DarkThreat.AI maintains persistent access to high-value forums through automated credential rotation and established collection nodes. Every brand mention is correlated against our stealer log database (containing billions of unique credential entries) to determine whether a forum post referencing your brand is backed by real, active credential exposure.

For organizations that must demonstrate due diligence for SEC disclosure requirements or compliance frameworks like SOC 2 and HIPAA, DarkThreat.AI generates an auditable timeline of brand mentions with severity classifications, evidence snapshots, and recommended response actions. The platform integrates directly with SOAR and SIEM systems via API, enabling automatic escalation of Critical and High-severity brand mentions into your incident response workflow. This turns brand mention tracking from a manual intelligence gathering task into a continuous, automated detection capability.

Common Challenges in Tracking Brand Mentions

Brand mention tracking is not a set-and-forget activity. Several persistent challenges can undermine even well-resourced programs. The first is keyword inflation: if your brand name is a common word or acronym, you will receive a high volume of false positives. For example, a company named "Phoenix Security" will have to filter out mentions of the Arizona city, the mythological bird, and dozens of other entities. The solution is to use compound keywords (e.g., "Phoenix Security VPN" instead of just "Phoenix") and to continuously refine your negative keyword list.

The second challenge is forum volatility. Forums are taken down by law enforcement, move to new .onion addresses, or change their access requirements. A monitoring program that relied on BreachForums in 2022 had to completely pivot within weeks of its seizure. Maintaining current knowledge of forum availability requires active engagement with the threat intelligence community or reliance on a platform that updates its source list continuously.

The third challenge is distinguishing between threat actor discussion and security researcher discussion. Many security researchers publish findings on dark web forums to understand threat actor behavior, and their posts containing your brand name can trigger alerts. This is not noise—it is a different category of signal that requires a different response (acknowledgment vs. escalation). Classification models that incorporate author behavior (posting history, known pseudonyms, language patterns) can help make this distinction.

According to the Verizon 2024 Data Breach Investigations Report, 83% of breaches involved external actors, and the dark web remains the primary marketplace for acquiring the access that enables those external actors. Brand mention tracking is the earliest warning system in the breach lifecycle.

Related Resources

• What Is Dark Web Monitoring and How It Works in 2025 — Foundational overview of the mechanisms behind dark web data collection, including the different source types and how monitoring platforms parse them.
• Initial Access Brokers and Why Dark Web Monitoring Must Track IAB Activity — Detailed look at how IABs operate on forums like Exploit.in and RAMP, and why they are the most common source of brand-targeting posts.
• The Connection Between Stealer Logs and Dark Web Monitoring — Explains how infostealer malware logs create the credential exposures that IABs then advertise, and how correlating forum mentions with log data validates threats.
• Using Dark Web Monitoring as a SOC 2 Compensating Control — For compliance teams: maps brand mention tracking processes to specific SOC 2 controls and evidence requirements.

Conclusion

Learning how to track brand mentions on dark web forums is a multi-step process that requires asset inventory, sustained access to volatile sources, automated collection and classification, and correlation with credential exposure databases. The organizations that invest in this capability gain a critical advantage: they see the targeting declaration before the ransomware deployment, the credential sale before the account takeover, and the vulnerability discussion before the exploit becomes public. The alternative is discovering your brand was discussed on XSS.is only after a breach notification arrives.

The dark web forum landscape will continue to fragment and harden its access controls in response to law enforcement pressure. As it does, the gap organizations that maintain manual tracking capability and those that leverage automated, persistent dark web monitoring will widen. Dark web intelligence is not a one-time assessment; it is a continuous, adversarial intelligence feed. Making brand mention tracking a core component of your security operations architecture is the only way to keep pace with the threat actors who are already monitoring your brand.