Dark Web Domain Monitoring
Leaked Logins and Dark-Web Posts That Name Your Domain
Every 24 hours the platform checks each of your domains for leaked logins and for dark-web forum posts that name it. Nothing is installed.
$4 per domain per month • No proof of ownership needed
What It Looks For
The platform looks for two things. The first is leaked logins, meaning usernames and passwords found in stealer logs and other leaked data. The data service sorts them into three groups by who they are linked to: staff, customers, and third parties connected to the domain. The second is dark-web forum posts that mention the domain by name.
Severity Follows Whose Login It Is
A staff login is Critical, since it may open your company email or an admin panel. A customer login is High, because the person it belongs to may not know it has leaked. Third-party records are Medium, and each check that finds new dark-web posts naming your domain raises a High alert. The grade is set when the alert opens and doesn't change. Password strength is shown next to each record but never moves the grade.
j••••@example-mail.com · acme-example.com/account/login
Reset this account's password →
2 new forum posts name acme-example.com
Read the previews in the portal →
How the Checks Run
There is nothing to set up: the checks run on the platform's own schedule and infrastructure. When one finds something, the platform grades it and raises an alert. Changing the password is up to you.
Checked Every Night
Each domain goes through a nightly check of the leaked login data, and the dark-web search for the same domain runs within the next 24 hours. A domain you add is first checked shortly after you add it, then every night.
Re-Checked When New Records Appear
When the data service reports new leaked logins for one of your domains, the platform checks that domain's logins again straight away instead of waiting for the night. There is no button to start a check yourself.
The Site Each Login Was For
Each leaked record shows the username, the web address it was used on (when the record has one), a password-strength rating and the date it was added. A staff password for your webmail is a bigger problem than one for a forum account, and the address tells you which one you have.
A Warning When an Old Password Comes Back
If a staff login turns up again with the same password as one already reported, the alert flags it and shows when that login was first seen. That's your cue to check whether the password was ever changed.
Passwords Are Never Stored
The platform never keeps a leaked password. For staff logins it stores a one-way hash instead, which is how it recognizes a password that comes back.
Alerts by Email, Portal and Slack
Leaked-login alerts are emailed as soon as they're found, and sent to Slack once you connect it. Dark-web posts show up in the portal, which lists every alert. Each leaked-login email lists the next steps: reset the affected passwords, turn on two-factor sign-in where it is off, and check for sign-ins you don't recognize.
What You See
For each domain the portal lists the leaked records and the site each one was for, with a password-strength breakdown above them. Dark-web posts that name the domain appear with a short preview, and a scan history keeps the counts from recent checks. If you resell it, your customers get the same alerts under your brand, and in your WHMCS client area if you run the module.
What You Do With a Finding
Reset the password, or get the account's owner to. Acknowledge an alert when someone has seen it and resolve it once it's dealt with, and the portal records who did each and when. New records for a group that has an open alert update that alert and notify you again instead of opening another. You only ever see the domains on your own account, and the free exposure check on this site shows a masked sample of the same data for any domain, with no signup.
4 new records since the last check
Force a password reset →
1 new record since the last check
Review the record →
What It Costs
For your own domains, the endpoint plans include 1 (Starter), 5 (Professional) or 15 (Business). Any other domain, with or without a plan, is $4 per domain per month, up to 200 domains; 10 such domains is $40 a month. Resellers pay $1.50 per domain per month, wholesale, so 10 domains is $15 a month, and set their own retail price.
Frequently Asked Questions
Where does the data come from?
From a specialist breach-intelligence service that indexes stealer logs (logins taken from infected computers by malware), leaked password lists and dark-web forums. The platform queries it for each of your domains and runs no crawlers of its own. It can only report what that service has indexed, so no check, this one included, finds every leak.
Will I get alerts for old leaks?
Yes, once. The first check alerts on every leaked login already on file for the domain, however old, and after that an alert means new records have turned up. The dark-web search starts with posts from the last 30 days.
Do I have to prove I own the domain?
No. Add any domain you are responsible for and the first check runs shortly after. Nothing is installed and nothing has to be added to the domain itself.
Are passwords stored?
No. For staff logins the platform keeps only a one-way hash, so it can tell when the same password comes back. The portal shows the account and the site each login was for, never the password.
Can I buy or resell it without endpoint monitoring?
Yes. It has its own per-domain price, for your own domains or for resale, and you don't need endpoint monitoring to use it.
Start With One Domain
$4 per domain per month for your own domains, or $1.50 wholesale when you resell it.
Start MonitoringOr create a partner account to resell it