View Domain Sightings
Domain Sightings enables your organization to detect and investigate sources where your domains or brand-related keywords appear on the dark web. This helps security teams monitor brand exposure, assess potential threats, and take proactive action to minimize risk.
View Domain Sightings List
The list displays dark web mentions of your organization’s domains. Use this section to review sightings detected on dark web forums, marketplaces, and other sources to monitor potential exposure.
Use the following information while viewing the list:
Search to quickly locate domain sightings.
Use the following filters to refine the results:
Discovered Date: Filter sightings based on the date they were first discovered.
Domain Name: Filter results based on the monitored domains associated with your organization.
Status: Filter by the current investigation status of the sighting, such as Open, Under Review, and Closed.
Use Sort by to sort the list in ascending or descending order using the Discovered Date and Last Recorded on columns.
The list displays the following information:
Source URL: View the dark web link where your organization was mentioned.
Discovered Date: View the date when the sighting was first detected.
Last Recorded On: View the most recent timestamp when the mention was seen or updated in the source.
Domain: View the domain associated with your organization that was mentioned in the dark web post.
Status: View the current status of the sighting.
Sources: View the source name that reported the sighting. For example, Cyware CCM.
To view a screenshot of the dark web post (if available), hover over a record, click the vertical ellipsis, and click View Image. Screenshots allow you to review the content safely without directly accessing the dark website.
View Domain Sighting Details
To view the details of a sighting, click the record of your preference, and use the following information:
In Breach Details, you can review the following key information about the sighting:
Website Name: Displays the name of the dark web forum or site where the domain appeared.
Discovered Date: Displays when the domain was first observed on the dark web.
Last Recorded On: Displays the most recent time the domain was found on the source.
Domain: Displays the domain that was detected.
Source URL: Displays the link to the dark web page, when available.
Type: Displays the type of source. For example, Darkweb
Source: Displays the integration that reported the sighting. For example, Cyware CCM
In Image Preview, view a screenshot of the page or post where your domain was mentioned, without directly accessing dark web forums. This protects you from exposure while allowing you to assess the threat safely. Expand the image for better visibility and take corrective action as needed.
Use the Timeline section to track all updates and actions related to the domain sighting. Use the following information to view timeline details:
View each event in reverse chronological order, with the most recent update appearing first.
Track actions such as status updates and any response actions taken on the sighting.
Check timestamps for each event to audit your team’s response history.
You can take actions on a domain sighting using Actions. Click the desired response action to trigger the associated playbook and initiate the action. To add or update available response actions, configure them in Settings. For more information, see Configure CCM.