DarkWeb Scanner
What is circulating about your company, you see here.
The DarkWeb Scanner checks your domains and e-mail addresses, from Corporate on your IP addresses too, every day against known data leaks, stolen credentials, ransomware publications and copycat domains. Built for the person who decides in the business — not for a security team.
Access is granted on request: you describe your company and domain, we activate.
Infostealer awareness · level 3
A machine is infected. The password is in the clear.
Malware reads the logins saved on a laptop — with device, malware and time. The scanner finds the log, rates it critical and can act at the directory at once.
A stealer log is not an old leak: the credentials are days old, the password usually still works, and often a session comes with it that gets past the password altogether. That is why every stealer log of an employee is critical, and why here it does not end with a notification.
- 1Alertat once by e-mail and Telegram, with device, malware and time.
- 2Password replaced from Corporateat the directory, Entra ID or Google Workspace.
- 3Sessions revoked from Corporateafterwards, never before — in exactly this order, at the push of a button or automatically.
- 4Logevery step with time and result, never with the password.
- 5Password check PROagainst your Active Directory, by k-anonymity: “in circulation” becomes “active”. No hash of a valid password leaves your house.
Immediate measures on findings: Microsoft 365 and Google Workspace — how it works from Corporate
- Access
- A dedicated technical emergency access that you create: for Microsoft 365 an app registration in Entra ID with a client secret, for Google Workspace a service account delegated to an admin account.
- Rights
- Exactly three things: find an account by its address, replace its password, revoke its sessions. No reading of mail, no other objects.
- Trigger
- A stealer log of an employee — never a combolist, never a client. With PRO also a password the Active Directory check confirms as active.
- Sequence
- Replace the password with a forced change, then revoke every session — at the push of a button from the alert or automatically on every new find of this kind.
- Security
- The secret is stored encrypted with us, every use is in the audit log. “Check connection” only reads; the connection is armed only after that.
- Afterwards
- Nobody knows the new password, not even we. The account stays locked until your IT assigns one — and every step is in the log, never the password.
Credential leaks · levels 2 and 1
Not every find weighs the same.
A password from a combolist is not the same as a hash from an old leak. The scanner rates every hit, groups it per leak and reopens what was resolved as soon as a new record turns up.
- 3Stealer logdevice, malware, todaycritical
- 2Combolistpassword, often recycledhigh
- 1Data breachaddress known, oldlow
Evidence
This is what it looks like in our database.
Three kinds of record, anonymised. The field names are the stored ones, the values masked — the application shows no more either.
Seen from outside
What is visible from outside, you see first.
Host names from the public certificate log, 31 checked ports, lookalike domains, SPF, DKIM and DMARC, ransomware publications — daily. A DNS record once set closes its own alert.
Notification
A message when it is urgent. A report when it is not.
High and critical finds go out at once by e-mail and Telegram. Everything else comes weekly in the digest and monthly as a PDF report with a risk score per domain.
After a hit, the help says what to do in the first hour and the first 24 hours — 33 typical mistakes in seven blocks.
Working in the SOC
Every alert has a person, a deadline and a way out.
Responsibility and a deadline per severity, exceptions with a rule, sign-in through Entra ID or Google Workspace. Every new alert goes out as a message or a ticket.
MSSP
Several clients, one sign-in.
A service provider invites its team, creates clients — company, plan, domains — and works inside a client with “Manage”, as if it were the client itself. A banner shows at all times where you are.
- One invoice, one organisation
- a retainer plus a price per client, billed to your organisation. A client can be ended and resumed later.
- Built for the SOC
- Assign alerts to a person — in your own team or at the client — with a deadline per severity. You enter the connection to Entra ID or Google Workspace per client.
- Partner API and export
- A key-authenticated API brings the findings into your own tools. Data export and erasure after the contract ends are part of it.
- Security Tools Beta
- Subdomains from the certificate log, 31 checked ports, DNS records and uploaded DMARC aggregate reports with 30-day sums per domain.
Pricing
All plans watch equally well.
They differ in how much is watched: IP addresses, Git repositories and your own dark web keywords come from Corporate. Prices in CHF per month, plus VAT. Cancel monthly, paid by card; MSSP organisations receive an invoice.
- from CorporateIP addresses, Git repositories and dark web keywords, immediate measures on findings (Microsoft 365, Google Workspace), Slack, Teams, Jira, ServiceNow, e-mail support
- Enterprise · PROPassword check against the Active Directory, your own webhooks, SIEM, prioritized e-mail support
E-mail addresses outside your domains: CHF 20 per address and month
All limits in detail →We grant a free trial with the invitation. It costs nothing, and at the end you decide: continue with a card, or sign out.