When you assess the security of a domain, it is tempting to focus on what you can see from the inside: your servers, your code, your configurations. But attackers do not start there. They start with what is already public, already leaked, and already indexed, long before they ever touch your systems. A thorough domain exposure review looks at your organization the way an attacker does, from the outside, using only data that already exists.
This checklist walks through what a complete external exposure review should cover. It is also, not coincidentally, what darkweb-scanner checks when you run a domain.
1. Leaked Credentials in Breach Data
The foundation of most account takeovers is a credential that leaked from somewhere else. The first thing to establish is which email addresses and passwords tied to your domain appear in breach corpora.
- Which corporate email addresses show up in known breaches, and in how many.
- Whether plaintext or cracked passwords accompany those addresses, which turns a name on a list into an immediately usable credential.
- How recent the exposure is, since a password leaked last month is far more likely to still be valid than one from years ago.
The goal is a clear answer to a simple question: which of our accounts could an attacker log into right now using credentials that already exist in a dump somewhere?
2. Infostealer Logs
Breach data tells you about old incidents. Infostealer logs tell you about infected devices right now. This is one of the most urgent categories of exposure and one of the most commonly missed.
- Which of your users appear in stealer logs, meaning a device they used was infected and its browser contents were harvested.
- What was captured, including saved passwords, the exact URLs they belong to, and in many cases live session cookies.
- Which internal and external systems the stolen credentials and cookies unlock, since stealer logs often map credentials directly to the applications they were used on.
An infostealer hit is more dangerous than a years-old breach entry because it can include active session tokens that bypass MFA entirely and credentials the user is actively using. darkweb-scanner draws on Hudson Rock Cavalier data specifically to surface this category.
3. Exposed Secrets and API Keys
Credentials are not only usernames and passwords. Developers and systems leak machine secrets constantly, and those often grant broader access than any single user account.
- API keys, access tokens, and cloud credentials committed to public code repositories, pastes, or misconfigured storage.
- Database connection strings and service credentials exposed in public artifacts.
- Secrets tied to your domain or organization that appear in places outside your control.
A single leaked API key can be worth more to an attacker than a thousand user passwords, because it may bypass the login flow entirely and act with elevated privileges.
4. External Attack Surface: Ports, Services, and CVEs
Everything your organization exposes to the internet is a potential entry point. Passive attack-surface mapping catalogs what is reachable without ever probing it intrusively.
- Open ports and the services behind them, drawn from internet-wide scan data such as Shodan.
- Service banners and versions, which reveal what software is running and how old it is.
- Known CVEs associated with those versions, so you can see which exposed services carry published vulnerabilities.
- Risky services that should rarely face the open internet, such as exposed databases, remote-desktop endpoints, and administrative panels.
This part of the review answers: if an attacker enumerated everything you have facing the internet, what would they find, and what of it is already known to be vulnerable?
5. Subdomains and Forgotten Assets
Attackers love the things you forgot about. Old marketing sites, staging environments, and legacy services often run outdated software and sit outside your monitoring.
- Enumerated subdomains tied to your primary domain, discovered through OSINT tooling such as theHarvester.
- Which subdomains resolve and respond, separating live assets from stale DNS records.
- Orphaned or staging assets that may be unpatched, unmonitored, or unexpectedly exposing internal functionality.
Shadow IT and abandoned infrastructure are a recurring source of breaches precisely because no one is watching them.
6. Account and Identity Footprint
Finally, a review should map the human and account footprint of the organization, because attackers use this for targeting, phishing, and reconnaissance.
- Employee names, roles, and email formats that can be inferred or discovered through public sources.
- Accounts and profiles tied to your domain or people across platforms, discoverable with username-enumeration tooling such as Maigret.
- The email-naming convention itself, which lets an attacker generate valid addresses for everyone in the company once they know a single example.
This footprint is the raw material for spear-phishing and for building the target lists used in credential-stuffing campaigns.
An Honest Word on Coverage
No external review is ever exhaustive. OSINT and breach-data analysis can only find what has already leaked, been indexed, or been made discoverable. A credential that leaked into a private channel that no feed has seen, a freshly infected device not yet in any log, or a service hidden behind defenses may not surface. A clean report means "nothing was found in the sources we checked," not "nothing exists." The right way to use a checklist like this is as a continuous, repeated measurement of known exposure, not a one-time certificate of safety.
What this review does give you is the attacker's starting map: the credentials, secrets, services, and identities that are already sitting in the open. Closing those gaps removes the easiest paths in, which is where most real attacks begin.
The Takeaway
A strong domain exposure review covers six fronts: leaked credentials, infostealer logs, exposed secrets, external attack surface, subdomains, and account footprint. Each one represents a way an attacker can make progress using data that already exists, entirely outside your perimeter and without touching your systems.
darkweb-scanner runs this full checklist against a domain using Hudson Rock Cavalier infostealer data, breach sources, Shodan attack-surface data, and FOSS OSINT tooling, then delivers a severity-ranked exposure report. Run a scan to see where your domain stands.