> For the complete documentation index, see [llms.txt](https://knowledge.whiteintel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledge.whiteintel.io/basics/dark-web-mentions.md).

# Dark Web Mentions

Dark Web Mentions refer to detections where one of your configured keywords appears on **dark web sources** monitored by WhiteIntel.\
Organizations can define keywords such as brand names, product names, executive names, or any other terms relevant to their risk profile.

Whiteintel continuously monitors a wide range of dark web resources, including:

* Hacker forums
* TOR-based marketplaces
* Cracking communities
* Leaked database hubs
* Underground chat platforms
* Paste sites and anonymous sharing services

When a monitored keyword appears on any of these sources, Whiteintel generates a **Dark Web Mention Record**, providing:

* The detected keyword
* Timestamp of the discovery
* Source type (forum, marketplace, chat, TOR site)
* Contextual text surrounding the mention (when available)
* Link or reference to the original post or resource

Examples of useful keywords include:

* Organization name: `Acme`
* High-value products: `Acme Cloud`
* Executive or VIP names: `John Doe`
* Internal project names or codewords
* Supply-chain partner names

Dark Web Mention monitoring allows organizations to:

* Detect discussions related to targeted attacks
* Identify leaked internal data or credentials being shared
* Spot brand impersonation or fraud attempts
* Track threat actor activity involving the organization
* Respond early to emerging risks before they escalate

By enabling keyword-based monitoring across dark web ecosystems, Whiteintel provides actionable visibility into threats that may otherwise remain hidden.