Your credentials are already out there — you just can't see them
Employee passwords leak through breaches of unrelated third-party sites and through malware on personal devices. By the time it shows up in an attack, it's months old.
Dark Web & Breach Exposure
The dark-web exposure report you can hand straight to a client.
Scan a domain against infostealer logs, breach data, and its external attack surface. You get a severity-ranked, remediation-ready PDF — which employees are compromised, what's exposed, and exactly what to reset. Not a wall of raw OSINT output.
No access to your systems. No install. No subscription.
The problem
Your credentials are already out there. You just can't see them.
Employee passwords leak through breaches of unrelated sites and through malware on personal devices. Session cookies get stolen and resold for a few dollars. None of it announces itself — it sits on dark-web markets and in stealer logs until someone uses it.
Infostealer logs are the real threat, and nobody's checking
A single stealer infection dumps live session cookies and saved passwords for every site that machine touched. These sell for a few dollars and bypass MFA — and they don't show up in a password-change prompt.
Nobody's built you the multi-client view
If you manage 30 clients, checking each one by hand across a dozen data sources is a side project you'll never finish. There's no single dashboard showing exposure across your whole book.
The deliverable
The report is the product.
Severity-ranked. Plain English. Ready to send.
Executive summary written for leadership, not engineers
Findings ranked by severity and recency, not alphabetically
Step-by-step remediation: forced resets, MFA, secret rotation, device cleanup
Each exposed credential tied to its breach source and date
Infostealer captures called out as active-compromise, not stale leaks
White-label option: your logo, your firm's name, on every page
The engine
The tools we run, so you don't have to.
Infostealer intelligence, breach data, and attack-surface recon — orchestrated into one scan and one report.
Hudson Rock CavalierInfostealer logs
Infostealer / stealer-log intelligence — which of your employees and users have been captured by malware like RedLine, Lumma, and StealC, including live session data.
ShodanAttack surface
Your external footprint — subdomains, exposed services and open ports, and known CVEs on internet-facing hosts tied to your domain.
theHarvesterOSINT
Open-source OSINT collection — emails, subdomains, and hosts gathered from dozens of keyless public sources, plus the Hudson Rock breach module.
MaigretAccount footprint
Maps usernames and handles tied to your people across 4,000+ sites — the public identity footprint attackers use for targeting.
Every scan runs the full engine. You get infostealer, breach, and attack-surface coverage in one pass — no setup, no API keys, no babysitting a dozen OSINT tools.
How it works
Add a domain, scan, report. About five minutes of your attention.
01
Add your domain
Enter the domain you want to scan. To scan a domain you don't own, verify control with a one-time DNS TXT record. Roughly 2 minutes.
02
We sweep every source
The scan queries breach corpora, stealer-log collections, combolists, paste sites, and leak sites for anything tied to your domain and people.
03
The scan runs
External lookups only — we never touch your network, systems, or endpoints. There's nothing to install. Most scans finish in a few minutes.
04
You get the report
A finished, severity-ranked PDF — branded as yours with white-label — plus the findings retained in your dashboard for trend tracking on the next scan.
How it stays safe
We never touch your systems.
A dark-web scan should never put your infrastructure at risk. Here's exactly what we do and don't do.
What we do
No access to your systems is required. To scan a domain you don't own, we ask for a one-time DNS TXT record to prove control — the same ownership check used by SSL and email providers. We query only external, already-leaked data; we do not probe, scan, or connect to your infrastructure.
What we never do
We don't touch your network, mailboxes, files, or endpoints — there is nothing to connect and nothing to install. We surface data that is already exposed on breach and dark-web sources. We never post, re-sell, or share the exposed data we find; it is shown only to your account.
- Domain-ownership verification via DNS TXT before scanning a domain you don't own.
- Findings are retained so you can trend repeat scans. You can delete your data at any time from account settings.
- Exposed credentials are shown masked by default and are accessible only to your account.
Who it's for
Two ways people use this.
MSPs and IT consultancies
You manage a book of clients and need an exposure check that's repeatable, defensible, and deliverable. Add a client domain, run the same sweep across every one, and hand each client a report with your logo on it. One dashboard shows exposure across your whole book, so you can spot the stealer infection that's hitting three clients at once.
See MSP pricingInternal IT and security teams
You need an outside read on your own exposure before the thing that's coming — a cyber-insurance renewal, an incident, a board review. One scan gives you a prioritized reset list and an evidence file, without a retainer or a headcount you don't have.
Scan your domainWhere this fits
The honest trade-off.
A free breach checker tells you about one email. Enterprise monitoring costs five figures. Here's where darkweb-scanner sits between them.
| DarkWebScanner | Free breach checkers | Open-source / manual | Enterprise monitoring | |
|---|---|---|---|---|
| Multi-client dashboard | Build it yourself | |||
| White-labeled client PDF | Build it yourself | Varies | ||
| Infostealer-log coverage | Rarely | If you source it | ||
| Historical trend tracking | Manual | |||
| Source + date on every finding | Partial | If you wire it up | Varies | |
| Domain-wide (not single-email) scan | Email only | If you script it | ||
| Setup effort | One DNS record | None | Source data, scripting | Implementation project |
| Time to first report | Minutes | N/A | Hours per domain | Weeks |
| Cost | $99 per scan | Free | Free + your time | Annual contract |
You're paying us for the domain-wide sweep, the infostealer coverage a free checker won't give you, and a client-ready report you don't rebuild by hand.
Compliance
The frameworks already require this.
Monitoring for exposed credentials isn't a nice-to-have you're proposing to your client. It's a control they're already measured against.
“Establish and maintain an inventory of accounts, and monitor for accounts and credentials that have been compromised or exposed.”
“Organizations should monitor for the exposure of credentials and promptly reset any that appear in breach or dark-web data.”
“Maintain a list of compromised passwords and prevent their use; monitor for credential exposure and require resets when exposure is detected.”
“Covered entities must implement procedures to guard against, detect, and report malicious software and unauthorized access to ePHI.”
Every finding in your report maps to the control it satisfies, so the evidence goes straight into the audit file.
See the deliverable
See a real report before you buy.
A full exposure report for a sample domain — executive summary, severity breakdown, and detailed findings with impact and remediation steps.
Get the sample report in your inbox.
A full exposure report for a sample domain — executive summary, severity breakdown, and detailed findings with impact and remediation steps.
Pricing
$99 per scan. No subscription, no seats, no contract.
One credit, one domain, the full engine, one finished report. Add white-label for $50 one-time to put your brand on every report.
Exposure Scan
$99one-time
1 domain scan · $99
- Full sweep across breach dumps, stealer logs, combolists, paste sites, and leak sites
- Every exposed account for your domain, with breach source and date
- Severity-ranked PDF with step-by-step remediation
- Infostealer captures flagged separately — these mean active compromise
- Historical tracking so you can trend repeat scans
- Credits never expire
Add-onWhite-Label Branding
Permanently removes darkweb-scanner branding from all your reports. Your logo, your firm name on every page. One-time purchase.
$50
Credits never expire. No subscriptions, no commitments.
Coverage
Every kind of exposure that gets a company breached.
One scan reads across credentials, infostealers, and attack surface.
Breached Credentials
Email/password pairs exposed in third-party data breaches, matched to your domain, with the breach name and date for each.
Infostealer Logs
Credentials and live session cookies harvested by stealer malware (RedLine, Raccoon, Lumma, etc.). These indicate an actively compromised device.
Combolists & Pastes
Appearances in aggregated combolists and public/private paste sites used to seed credential-stuffing attacks.
Exposed Secrets
Leaked API keys, tokens, and credentials tied to your domain found in public repos, pastes, and dumps.
Leak-Site Mentions
Mentions of your domain or company on ransomware and data-leak sites, forums, and marketplaces.
From the blog
Dark-web & exposure guides, straight from the field.
Practical explainers on infostealers, breaches, and exposure monitoring.
FAQ
Common questions
01Does the scan touch our systems?
No. We query external, already-leaked data — breach corpora, stealer logs, combolists, paste and leak sites. There's no network probing, no traffic to your endpoints, and nothing to install.
02How do you know the data is ours?
We match on your domain. To scan a domain you don't own, we ask for a one-time DNS TXT record to verify control — the same ownership check SSL and email providers use.
03What's the difference between a breached password and a stealer log?
A breached password leaked when some third-party site you used was hacked — reset it and you're fine. A stealer log means malware is (or was) running on a device, dumping live passwords and session cookies that can bypass MFA. We flag these separately because they mean active compromise, not just a stale leak.
04What happens to our data after the scan?
Findings are stored so you can trend repeat scans, and are accessible only to your account. You can delete your scan data at any time from account settings.
05How long does a scan take?
Most scans finish in a few minutes.
06What does a scan actually get me?
Every exposed credential and record tied to your domain across all sources, each with its breach source and date, severity-ranked, plus a full PDF report and the findings retained for trend comparison on future scans.
07Can I put my own branding on the report?
Yes — $50 one-time enables white-label permanently across every report on your account.
08Do credits expire?
Never.
Find out what's already exposed.
Enter a domain, run the full engine, and get a report you can send to a client the same afternoon. $99, one time.