Data Points

📋 Paste / Leak Post

Text posted to a paste site or leak forum — a frequent first appearance of stolen data.
Dark & Leak

Sources

8
5 no-auth

Disciplines

2
that use it

Mission domains

5
reach

Workbench

—
native tool

🔗 Analyst pivots

Search platform →OSINT pivot →Source catalog →

🔌 Sources that yield Paste / Leak Post (8)

SourceCategoryAuthFormat
AIL Framework (CIRCL)
Open-source framework to crawl and analyse pastes, leaks and onion sites for leaked inform		Paste MonitoringNONEhtmlhome↗
Lyzem
Free search engine indexing public Telegram channels, groups, bots and messages.		Telegram OSINTNONEhtmlhome↗
Pastebin Dump Monitor (PSBDMP)
Paste-site leak monitoring.		PASTINTNONEjsonhome↗ api↗
PhoneBook.cz
IntelX-powered lookup listing all domains, email addresses and URLs found for a given sele		Leak AggregatorNONEhtmlhome↗
psbdmp (Paste Dump)
Searchable archive of 28M+ removed/expired Pastebin dumps by email, domain, keyword or dat		Paste MonitoringNONEresthome↗ api↗
Have I Been Pwned
Canonical breach index; breach-catalog endpoints are free/no-auth, account lookups need a 		Breach SearchKEYresthome↗ api↗
Pastebin Scraping API
Primary public paste host; real-time scraping API requires paid PRO account and IP whiteli		Paste MonitoringKEYresthome↗ api↗
TGStat
Telegram channel/group analytics and search with a free API tier (post search, channel sta		Telegram OSINTKEYresthome↗ api↗

🧭 Disciplines

PASTINT (8) →DARKINT (4) →

🎯 Mission Domains

Cyber Crime (8) →Fraud & Identity (7) →Dark Web Intel (1) →Disinformation / IO (1) →Drug Trafficking (1) →

🔍 Lookup

🔄 Live Datasets & APIs (2 key-free · ingestible)

Dataset / APIFormatEndpoint
Pastebin Dump Monitor (PSBDMP)jsonhttps://psbdmp.ws/api/collect
psbdmp (Paste Dump)resthttps://psbdmp.ws/api/v3/search/collect
Run Auto-Collect Datasets Hub Import

📜 Playbook — Paste / Leak Post exploitation

  1. Direction — frame the requirement for Paste / Leak Post: what decision does this support, by when?
  2. Collection — pull the 8 mapped sources (5 free) and the native workbench; capture provenance and observe OPSEC.
  3. Processing — normalize, de-duplicate and enrich the collected data.
  4. Analysis — correlate against local holdings; apply ACH; assign confidence.
  5. Dissemination — open a case, draft a report, share via STIX/MISP.
  6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief⚡ AI SkillsResolveEnrichAuto-CollectHuntReportExport

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case+ CampaignWatchlistTagSave searchWhitelistExport STIX/MISPReport

🧩 Advanced Capabilities

Link AnalysisPivot ExplorerTimelineThreat HuntingAnalyticsDetection RulesBlockchainOSINT PivotPassive DNSTAXII 2.1MISP FeedCreate Alert RuleNetFlowCoverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 Paste / Leak Post

A paste / leak post is content published to a paste site, leak forum, ransomware blog, or Telegram channel, frequently containing credentials, source code, PII, or database dumps. It matters for early breach detection, credential-exposure monitoring, and tracking threat actors who broker or dump stolen data.

Format: Paste URL or id (e.g. pastebin.com/<8-char id>), forum thread/post id, or .onion URL; free-text body often embedding structured dumps (email:password combolists, SQL, JSON)

📡 How it is collected

  • Paste-site scraping / APIs
  • Leak-forum and marketplace monitoring
  • Telegram leak-channel ingestion
  • Tor / hidden-service crawling
  • Ransomware leak-site mirroring
  • Combolist and stealer-log feeds

📚 Enrichment &amp; validation sources

Have I Been Pwned →Intelligence X →PSBDMP →Leak-Lookup →ransomware.live →Ransomwatch →GitHub secret scanning →Doxbin monitors →

🔗 Pivot to

Email Address →Credential / password hash →Domain Name →dp_actor / threat-actor handle →dp_crypto_address (ransom wallet) →Victim organization →URL →

🧩 Analysis &amp; hunting techniques

  • Credential extraction and parsing
  • Regex / entropy secret detection (API keys, tokens)
  • PII detection and classification
  • Actor-handle correlation across sources
  • Breach clustering and de-duplication
  • Combolist validation / stuffing-risk scoring
  • Onion-to-clearnet operator linkage

🔧 Tools

  • trufflehog
  • gitleaks
  • PSBDMP
  • Intelligence X
  • SpiderFoot
  • Recon-ng
  • Have I Been Pwned API

⚡ Workbench actions

  • Extract credentials
  • Scan for secrets
  • Screen emails against HIBP
  • Detect and redact PII
  • Attribute actor handle
  • Archive / snapshot paste
  • Hash and de-duplicate
  • Alert affected domains

📊 Dashboard KPIs

Credentials foundUnique emails exposedSecret / key hitsImpacted victim orgsPaste freshness (age)

📂 Open

Paste data point →Email profile →IOC workbench →Actor profile →OSINT console →Correlate →
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center