Searching the company name is the easiest and least productive method. Yield lives in terms that are specific and hard to imitate.
The first move of a newly formed dark web monitoring team is to put the company name into the keyword list. That list produces hundreds of irrelevant results within days.
Better keywords
- Corporate mail domains and subdomains.
- Internal system names: the VPN banner, the portal name, the ticket prefix.
- IP ranges and the ASN name.
- Product code names and project names.
- Executive names — an early signal of impersonation and phishing preparation.
Evaluating a match
Not every match is a finding. Three questions build the filter: is the post new or a repost of an old data set, is the seller's history verifiable, and does the sample data match the format of a corporate system.
False negative risk
Most closed forums are invisible to search engines and require membership. When asking about a monitoring service's coverage, do not ask "how many sources" but "which closed sources, and how is access verified".
