Help Center

darkweb-scanner is fully hosted — there's nothing to install, and we never touch your systems. From sign-up to your first exposure report is a few minutes:

1. 1
   Create your account

   Sign up with email or Google. Your account is created instantly.

2. 2
   Enter your domain

   Type the company domain you want to scan (for example, yourcompany.com). No agents, no access to your accounts, no credentials shared — we only query external and already-leaked data.

3. 3
   Run your scan

   Launch the scan and we check your domain against infostealer/stealer-log data (Hudson Rock Cavalier), known breach data, and your external attack surface (Shodan). The scan runs in the background.

4. 4
   Get your report

   Results appear as a severity-ranked PDF exposure report you can download, share, or email to a client.

darkweb-scanner only queries external and already-leaked data sources — the same open and commercial intelligence feeds that attackers use. We never connect to, authenticate into, or read from your Microsoft, Google, or any other internal systems.

1. 1
   Infostealer / stealer logs

   We check Hudson Rock's Cavalier dataset for employees and users whose devices were infected by infostealer malware, exposing passwords, session cookies, and corporate app logins.

2. 2
   Breach data

   We match your domain against known data-breach collections to surface leaked credentials and exposed email addresses tied to your organization.

3. 3
   External attack surface

   Using Shodan, we map internet-facing hosts, open ports, and exposed services on your domain and its infrastructure.

4. 4
   Severity ranking

   Every finding is scored by severity so you can see the highest-risk exposures first, then work down the list.

Every scan correlates infostealer logs, breach data, and attack-surface findings for a single domain. Results are compiled into a professional PDF exposure report.

• •Scans cover infostealer-infected users (Cavalier), leaked and breached credentials, exposed email addresses, and internet-facing hosts and services (Shodan).
• •Reports include an executive summary, severity-ranked findings, affected accounts and assets, and recommended remediation steps.
• •White-label buyers get their own logo and org name on every report — no darkweb-scanner branding.

darkweb-scanner is self-serve and pay-as-you-go. One scan covers one domain, and there's no subscription — you only pay when you run a scan.

• •One scan is $99 one-time and covers one domain.
• •White-label branding is a $50 one-time add-on.
• •No subscriptions and no recurring fees — pay per scan.
• •All billing is handled securely through Stripe.

Exposure is never static — new infostealer infections and breaches surface constantly. Re-run a scan whenever you want a fresh picture of your domain's exposure.

• •Run a new scan on the same domain any time to pick up newly leaked credentials and newly exposed assets.
• •Compare a new report against a previous one to see what changed since you last scanned.
• •Many teams re-scan monthly or after a suspected incident to confirm nothing new has leaked.

Consultants and MSPs can deliver exposure reports under their own brand — add white-label for $50 one-time and every report carries your logo and org name instead of ours.

• •Your logo and company name on the cover and throughout the PDF.
• •Hand clients a polished, branded dark-web exposure report with no darkweb-scanner branding.
• •Perfect for prospecting, security reviews, and ongoing client reporting.

darkweb-scanner is for domains you own or have explicit written authorization to assess. We only query external, already-leaked data — we never access, authenticate into, or modify your systems.

• •No access to your environment: we take a domain as input and query third-party intelligence sources (Cavalier, breach data, Shodan). No passwords, tokens, or admin consent are ever involved.
• •We surface data that has already been leaked or exposed publicly — we do not hack, intrude, or test your infrastructure.
• •Your scan data is stored encrypted and isolated per-account. You can delete any scan or your entire account at any time.