How to Monitor the Dark Web for Data Breaches

#!/usr/bin/env python3
"""Check if a password appears in HIBP breach database."""
import hashlib
import requests
import sys

def check_password_hibp(password: str) -> int:
    """Returns the number of times this password appears in breaches."""
    sha1 = hashlib.sha1(password.encode()).hexdigest().upper()
    prefix = sha1[:5]
    suffix = sha1[5:]

    response = requests.get(
        f"https://api.pwnedpasswords.com/range/{prefix}",
        headers={"User-Agent": "PasswordChecker/1.0"}
    )
    response.raise_for_status()

    # Look for our suffix in the response
    for line in response.text.splitlines():
        hash_suffix, count = line.split(":")
        if hash_suffix == suffix:
            return int(count)
    return 0

if __name__ == "__main__":
    password = sys.argv[1] if len(sys.argv) > 1 else input("Password to check: ")
    count = check_password_hibp(password)
    if count > 0:
        print(f"FOUND: This password appears {count:,} times in breach data.")
        print("Change it immediately everywhere it's used.")
    else:
        print("Not found in known breach data.")

#!/usr/bin/env python3
"""Monitor multiple email addresses for new breach appearances."""
import requests
import time
import json
from pathlib import Path

API_KEY = "your-hibp-api-key"
EMAILS = [
    "primary@example.com",
    "backup@example.com",
    "work@example.com"
]
STATE_FILE = Path("/home/user/.hibp-state.json")

def get_breaches(email):
    """Get list of breach names for an email."""
    url = f"https://haveibeenpwned.com/api/v3/breachedaccount/{email}"
    headers = {
        "hibp-api-key": API_KEY,
        "User-Agent": "PersonalBreachMonitor/1.0"
    }
    resp = requests.get(url, headers=headers)
    if resp.status_code == 404:
        return []
    resp.raise_for_status()
    return [b["Name"] for b in resp.json()]

def load_state():
    if STATE_FILE.exists():
        return json.loads(STATE_FILE.read_text())
    return {}

def save_state(state):
    STATE_FILE.write_text(json.dumps(state, indent=2))
    STATE_FILE.chmod(0o600)

def check_all():
    state = load_state()
    new_breaches = {}

    for email in EMAILS:
        current = set(get_breaches(email))
        known = set(state.get(email, []))
        new = current - known

        if new:
            new_breaches[email] = list(new)
            print(f"NEW BREACH for {email}: {', '.join(new)}")

        state[email] = list(current)
        time.sleep(1.5)  # Respect rate limit

    save_state(state)

    if new_breaches:
        # Send notification (customize for your notification method)
        print("\nACTION REQUIRED:")
        for email, breaches in new_breaches.items():
            print(f"  {email}: change password on sites related to {', '.join(breaches)}")
    else:
        print("No new breaches found.")

if __name__ == "__main__":
    check_all()

#!/usr/bin/env python3
"""Monitor Pastebin for references to your domain or email."""
import requests
import re
import time

def check_pastebin_for_domain(domain: str):
    """Search Google cache of Pastebin for domain references."""
    # Note: Pastebin's own API requires a subscription for paste search
    # This uses a public monitoring approach via HIBP's paste API:
    email = f"admin@{domain}"  # adjust to your email
    url = f"https://haveibeenpwned.com/api/v3/pasteaccount/{email}"
    headers = {
        "hibp-api-key": "your-api-key",
        "User-Agent": "PasteMonitor/1.0"
    }
    resp = requests.get(url, headers=headers)
    if resp.status_code == 404:
        print(f"No pastes found for {email}")
        return []

    pastes = resp.json()
    for paste in pastes:
        print(f"Found in paste: {paste.get('Source')} - {paste.get('Id')}")
        print(f"  Posted: {paste.get('Date')}")
        print(f"  Email count: {paste.get('EmailCount')}")
    return pastes

check_pastebin_for_domain("yourdomain.com")