Dark Web Domain Monitoring
Every Leaked Credential and Dark-Web Mention, Domain by Domain
Every 24 hours the platform checks each monitored domain against a breach-intelligence dataset for leaked credential records and dark-web forum posts that name it. No proof of ownership is needed.
$1.50 per domain per month • Re-checked the moment the data provider reports new records
What Dark Web Domain Monitoring Checks
Two things per domain. Leaked credential records come back in three groups, the organization's own staff, its customers and third parties, each with password-strength statistics alongside. Indexed dark-web forum posts that name the domain are searched separately.
Severity Follows Whose Credential It Is
A leak involving an address on the monitored domain itself, the organization's own staff, is Critical. A leak involving that organization's customers is High, and a leak involving a third party is Medium. Any new dark-web mention of the domain is High. Severity is set when the issue is created and never moves: later records update the counts on the issue that is already open, and nobody can override the grade. Password strength is shown beside the records and does not change it. A leak issue is never Low.
j••••@example-mail.com · a customer of acme-example.com
Ask them to reset this password →
acme-example.com named in a dark-web forum post
Review the post →
How Dark Web Domain Monitoring Works
The checks run automatically, to a schedule, on the platform's own infrastructure. The platform finds the exposure, grades it and delivers the alert. Your customer resets the password, and you support your customer.
Checked Once Every 24 Hours
Each monitored domain is checked against the credential dataset in a nightly run, and the dark-web search runs on the same pass, spread across the following 24 hours. A newly added domain gets its first check at the next nightly run.
An Immediate Re-Check on New Records
The data provider can push a notification the moment new records appear for a domain, and that triggers a re-check straight away instead of waiting for the next night. Neither you nor your customer can trigger a re-check by hand.
The Same Leak Is Never Reported Twice
When a check returns records that belong to an issue already open, the counts on that issue are updated rather than a second issue being created. Your customer sees one issue per exposure, with one timeline.
Plaintext Passwords Are Never Stored
The platform keeps a one-way fingerprint, which is what lets it recognize a credential that reappears in a later record, plus the source and the date the record was indexed. Usernames outside the staff group are shown masked.
No Ownership Check
A customer can monitor any domain they are responsible for: there is no ownership step to pass and nothing to install or add to the domain. The first check runs at the next nightly run rather than the moment the domain is added.
Alerts by Email, Portal, Client Area and Slack
Alerts reach the customer by email and in the portal, in your WHMCS client area if you run the module, and in Slack once they connect it. Each customer picks immediate alerts or an hourly, daily or weekly digest, and every alert carries signed one-click links that work without logging in first.
What Your Customer Sees
The portal shows the number of credential records in each group, the password-strength summary that came back with them, the dark-web forum posts that name the domain, and a timeline for every issue, all under your branding.
What a Customer Does With a Finding
An issue can be acknowledged, meaning someone has seen it, and then resolved, meaning it has been dealt with, and who did each step is recorded against it. A customer only ever sees the domains on their own account. The free exposure check on this site shows one slice of the same data for any domain, with no signup.
4 records · weakest password 6 characters, no symbols
Ask them to reset these passwords →
1 record · indexed 12 August
Review the record →
One Rate Per Domain
You pay $1.50 per domain per month, wholesale, in USD. 10 domains at $1.50 each is $15 a month. You set the retail price and keep the difference.
Frequently Asked Questions
Where does the data come from?
From a specialist breach-intelligence service that the platform queries on the customer's behalf; the platform runs no crawlers of its own. For each monitored domain it returns leaked credential records in three groups, the organization's own staff, its customers and third parties, together with password-strength statistics. It separately searches indexed dark-web forum posts that mention the domain, so one service answers both halves of the check.
How often is it refreshed?
Each monitored domain is checked once every 24 hours in a nightly run, and the dark-web search runs on the same pass, spread across the following 24 hours. The data provider can push a notification the moment new records appear for a domain, which triggers an immediate re-check. A newly added domain gets its first check at the next nightly run, and neither you nor your customer can trigger a re-check by hand.
How is a leaked credential's severity decided?
By whose credential it is. A leak involving an address on the monitored domain itself, the organization's own staff, is Critical; a leak involving that organization's customers is High; a leak involving a third party is Medium. Any new dark-web mention of the domain is High. Severity is fixed when the issue is created, later records update the counts on the existing issue, and nobody can override the grade, so a leak issue is never Low.
Does my customer have to prove they own the domain?
No. There is no ownership check on a monitored domain, so a customer can add any domain they are responsible for and the first check runs at the next nightly run. Nothing is installed and nothing has to be added to the domain itself.
Are passwords stored?
No plaintext password is ever stored. The platform keeps a one-way fingerprint, which is what lets it recognize a credential that reappears in a later record, plus the source and the date the record was indexed. Usernames outside the staff group are shown masked, so your customer sees the scale of an exposure without the credential itself.
Can I sell dark web domain monitoring on its own?
Yes. Endpoint monitoring and dark web domain monitoring are separate products at $1.50 each per month, and you are billed only for what you provision. Sell either one by itself, sell both, or put dark web domain monitoring alongside a hosting plan at whatever retail price you set.
Sell Dark Web Domain Monitoring Under Your Own Brand
Wholesale is $1.50 per domain per month, and nothing is owed before your first customer is active.
Create a Partner AccountOr explore the live demo