Are your company's logins for sale?
Enter your domain. We check stealer logs, the logins stolen from infected computers and sold on criminal markets, and tell you what each finding means and what to do. About 30 seconds.
A Cloudflare human check runs in the background and only asks for a click when it has to.
Free · No sign-up · Public sources only · See plans and prices
Scanning
About 30 seconds. Every check reads public sources only, and each one appears here as it finishes.
Reading DNS, mail authentication, look-alikes, certificates and breach signals…
Your exposure snapshot
The sources these checks read did not answer during this scan. They are left out, not counted as clean, so there is no overall grade until they run. Scan again later, or monitor this domain and it is checked again on its own.
A free scan looks up your domain, not each person. It does not check which staff addresses turn up in other companies' breaches. Monitoring does, for every address you add.
Each check, and what it found.
A check that could not run says so. It is never counted as nothing found.
Where to start.
Ranked by what an attacker would use first, and what to change in your own DNS or accounts. The full report names the exact accounts, people and hosts.
How this could be used The usual way in, against what this scan saw
Select a stage to see what it is, and what breaks it.
Get the full report at your company inbox.
It names the people and accounts behind each finding, so we only send it to an address at the domain you scanned.
- Every finding, with the evidence behind it
- What breach and infostealer data shows for your domain
- The leaders named on your pages, and what we found for them
- Every registered look-alike, with its mail and web status
- The record or setting that fixes each one, and what was not checked
One email with a private link to the report, which works for 14 days. Free scan results are deleted after 90 days. See our privacy notice.
Exposure changes every week. New look-alikes get registered and new leaks surface. Monitoring re-scans on a schedule, tells you what changed and proves each fix with a re-scan.
Exactly what this checks, and what it does not.
Plenty of scans promise "the dark web". We would rather tell you which sources we read, so you know what a clean result means.
What this checks
- Stealer logs for your domain. Logins and sessions taken from your staff's computers by password-stealing malware, through Hudson Rock's infostealer intelligence.
- Breaches of your own website. The public list of breached sites, from Have I Been Pwned.
- How a stolen login gets used. Email anyone can fake in your name, look-alike domains, and the sign-in pages under your domain where a stolen password gets typed.
What it does not
- Forums and chat channels. We do not watch them, so we do not claim to.
- Each staff address, one by one. That needs your staff list: monitoring checks every address you add against breach databases, once the domain is shown to be yours.
- The passwords themselves. We keep only that a password was there, how many and which malware took them. Nobody, us included, holds them.
Thirty seconds, then a plan.
No account, no agent, nothing installed. We read what anyone on the internet can already see, and what is already on sale.
Enter your domain.
Your company domain, or your work email and we take the domain from it.
We search the stolen-login sources.
Stealer logs and breach records for your domain, alongside the six checks that show how a stolen login would be used.
See what it means.
A grade, what each check found, and the first things to fix, ranked by what an attacker would use first.
Then keep it fixed.
Monitoring checks again on a schedule, tells you what changed, and proves each fix with a re-scan.
Seven checks, and where each one looks.
Named, so you know what a clean result covers. Nothing here touches your systems.
| Check | What it looks at | Where it comes from |
|---|---|---|
| Leaked credentials | Staff computers caught by password-stealing malware, and breaches of your own website. | Hudson Rock's infostealer intelligence; Have I Been Pwned's list of breached sites |
| Email spoofing | Whether mail can be forged as your domain: SPF, DKIM and DMARC as published. | Your domain's public DNS |
| Look-alike domains | Registered near-copies of your name, and which of them can already send or receive mail. | Public DNS |
| Executive exposure | Leaders named on your public pages: the target list for CEO fraud. With monitoring, their addresses are checked against breach data. | Your own public web pages |
| Sign-in surface | VPN portals, webmail and admin logins anyone can find under your domain. | Certificate transparency logs and public DNS |
| Third parties | Who runs your DNS, who may send mail as you, and who sees your mail flow. | Public DNS records |
| Web and TLS | Certificate health and the security headers a modern site is expected to send. | Your website, as any browser sees it |
We read. We do not touch.
- Public sources only. Nothing is installed, nothing logs in, and no password is ever tried.
- Nobody at your company is contacted. The only email is the full report, and only if you ask for it at an address on your domain.
- Your result is yours. It opens at a private link that only you are given, and never shows the names behind a finding.
- Kept for 90 days. Then the result and its link are deleted. Scan again any time.
More in our privacy notice.
Questions, answered.
What is the dark web, here?
What is a stealer log?
Will you show me the passwords?
What do you check, exactly?
What do you not check?
I found something. What now?
Find out before someone uses them.
Check your domain for stolen logins now, then fix the first things before anyone signs in with them.