Dark Web Monitoring API: How to Automate Exposure Checks

TA dark web monitoring API lets you query your organisation’s exposure programmatically instead of reading a dashboard: leaked credentials, squatting and typosquatting domains, phishing sites impersonating your brand, fake social accounts and trademark misuse. ImmuniWeb exposes this through a REST API and a command-line tool, iwtools, available as a Python script and a Docker image, so checks can run on a schedule, feed a SIEM, or gate a third-party onboarding workflow.

Dark web monitoring usually arrives as a dashboard and a weekly email. That works until you need the data somewhere else: in your SIEM next to everything that fires an alert, in the vendor onboarding checklist your procurement team runs, in the nightly job that compares this week’s exposure with last week’s.

At that point you need an API. This guide covers what a dark web monitoring API returns, how to call ImmuniWeb’s, and the four integration patterns that come up most often.

What a dark web monitoring API returns

Six data classes, all keyed to a domain you control.

Leaked credentials. Email addresses and passwords belonging to your domain that appear in breach dumps and combolists. This is the class most people mean by dark web monitoring, and it is directly actionable: force a reset, check whether those accounts have MFA.

Squatting and typosquatting domains. Registered domains that resemble yours through character substitution, added words or alternative TLDs. New registrations against your brand are the earliest warning of a phishing campaign, often days before it launches.

Phishing and scam websites. Live sites impersonating your brand, which feed a takedown workflow.

Fake accounts on social networks. Profiles using your brand, logos or executives’ names, typically for fraud or recruitment scams.

Trademark infringement. Unauthorised use of your marks across the sites and channels being monitored.

Cloud storage exposure. ImmuniWeb’s quick test covers AWS, Azure and GCP exposure alongside the dark web check, which is often where the actual data is sitting.

ImmuniWeb’s dark web monitoring API

The Dark Web and Threat Exposure Test is free to run from the browser and is also exposed as a REST API. Full parameter reference is in the API documentation.

A premium Community Edition account provides the API key that unlocks full API functionality, full technical detail in results and PDF export. Test limits per month are listed on the Premium & Limits page.

Using the CLI

iwtools is the supported command-line client, available as an open-source Python script and a Docker image. Python 3.7 or newer is required.

Install:

git clone "https://github.com/immuniweb/iwtools.git" && cd iwtools/iwtools
python3 -m venv env
source ./env/bin/activate
pip install -r requirements.txt

Start a test, or return a cached result if one exists:

./iwtools.py darkweb example.com

Return the raw API response as JSON, which is what you want for anything automated:

./iwtools.py darkweb --format raw_json example.com

Force a fresh test with an API key, from the Docker image:

docker run immuniweb/iwtools darkweb --api-key ABCDE-12345-FGHIJ-67890 --recheck example.com

Or from the Python script:

./iwtools.py darkweb --api-key ABCDE-12345-FGHIJ-67890 --recheck example.com

Note the difference between a cached and a forced result. Without --recheck you get the last known state, which is fast and cheap and fine for a dashboard. With --recheck you get a fresh scan, which is what a scheduled job should use.

Four integration patterns

Scheduled exposure check with diff

The most common pattern. Run a forced check on a schedule, store the raw JSON, compare against the previous run and alert only on what is new. The value is in the delta: a list of a thousand historical leaked credentials is noise, three that appeared yesterday is an incident.

Weekly is a reasonable baseline for a stable organisation. Daily makes sense if you are in a sector that is actively targeted.

Feeding a SIEM

Convert the JSON into events and ship them with everything else. Leaked credentials for privileged accounts and newly registered lookalike domains are both worth a correlation rule. A new typosquatting domain plus a spike in inbound mail referencing it is a phishing campaign in progress.

Third-party and vendor onboarding

Run a check against a supplier’s domain as part of due diligence. Heavy credential exposure or an active phishing campaign against a vendor is information you want before connecting systems, not after. This slots into an existing third-party risk management process as one more automated gate.

Pre-launch check on new brands and domains

When a new product name or domain is registered, run a check against it immediately. Squatting domains are often registered within hours of a public trademark filing or a domain purchase becoming visible.

What to do with the findings

An API is only useful if the output goes somewhere.

Leaked credentials go to a forced password reset and an MFA audit for those accounts. If the same address appears across several unrelated breaches, the person behind it probably reuses passwords everywhere.

New squatting domains go to a watchlist, and, if they start resolving to a live page, to a takedown request. ImmuniWeb offers phishing websites takedown as a managed service, which matters because registrar and host abuse processes are slow and inconsistent.

Fake social accounts go to each platform’s brand impersonation process, which is generally faster than domain takedowns.

From API to continuous monitoring

An API call is a snapshot. For exposure that appears between calls, continuous monitoring is the right model.

ImmuniWeb® Discovery runs dark web monitoring continuously as part of Continuous Threat Exposure Management, alongside external attack surface discovery, so newly exposed assets and newly leaked credentials surface in the same place rather than in two unconnected tools. It integrates with Jira, Splunk, Slack and Teams, among others, so findings land in the workflow your team already uses.