What is dark web monitoring?
When Shieldome scans a domain, it also checks two external threat intelligence sources to determine whether credentials associated with that domain have been compromised and are circulating on criminal marketplaces:
- HudsonRock Cavalier - infostealer malware database. Tracks credentials exfiltrated by malware like Redline, Raccoon, and Vidar from infected employee and user devices.
- Have I Been Pwned (HIBP) - aggregates data from known public data breaches. Covers email addresses tied to corporate domains that appeared in breach dumps.
Passive only. Dark web checks query read-only threat intelligence APIs. No data is submitted; no credentials are tested against your systems. This is purely observational intelligence.
How it works
- Shieldome extracts the root domain from your target URL (e.g.
https://staging.acme.com→acme.com) - HudsonRock is queried for the number of employee and user records linked to that domain in their infostealer database
- HIBP is queried for any known data breaches exposing addresses under that domain
- Findings appear in your scan results under the 🌑 darkweb scanner badge
Severity thresholds
| Condition | Severity | Meaning |
|---|---|---|
| Compromised employee records found (infostealer) | CRITICAL | Active malware exfiltration - credentials stolen from employee devices are actively available to threat actors |
| More than 100 compromised user records (infostealer) | HIGH | Significant user credential exposure - customer accounts may be at risk |
| Domain found in a public data breach (HIBP) | HIGH | Email addresses under the domain appeared in at least one publicly known breach |
Reading the findings
Each dark web finding includes:
- Source - which intelligence source detected the exposure (HudsonRock or HIBP)
- Count - number of compromised records (employees, users, or breach events)
- Recommendation - specific remediation steps: forced password resets, MFA enforcement, session invalidation
No false positives from subdomains. The check always runs against the root domain (e.g.
acme.com), not the subdomain you scanned. Results reflect exposure for the entire organization, not a single host.
Remediation steps
When a dark web finding is detected:
- Force password resets for all affected accounts - employees first if infostealer records are found
- Enforce MFA for all accounts, not just affected ones - stolen passwords are useless with MFA
- Invalidate all active sessions to prevent continued access with stolen tokens
- Audit recent logins for affected accounts - look for logins from unusual IPs or geographies
- Review and rotate API keys that may have been in the compromised environment
- Run an endpoint security scan on devices used by affected employees to detect and remove malware
HIBP API key (optional)
Shieldome uses HudsonRock's public API (no key required) and HIBP's free tier. HIBP Pro gives higher rate limits and access to additional breach metadata. To use your own HIBP Pro key, set the HIBP_API_KEY environment variable on your Shieldome instance.
Self-hosted users: see the self-hosting guide for environment variable configuration.