Dark Web Monitoring
Your company's credentials that are already in circulation, and your name on the sites where ransomware groups publish their victims.
Your staff's passwords are already out there
Not because someone attacked you, but because a service they had signed up to with their work email was breached. Those credentials end up in archives that are bought and traded, and sooner or later someone tries them on your email.
Dottor Box looks for credentials from your email domains in an archive of more than 14 billion compromised hashes and passwords, gathered from many different breaches. Knowing which accounts are exposed, and which breach they come from, lets you force a password change before they are used.
At the same time, every day we check the sites where ransomware groups claim their attacks: if the name of your company or one of your brands appears, you know straight away. And not from a journalist's phone call.
What you get
Credentials with their source
Company emails and passwords found in data breaches, with the name of the breach they come from.
Alerts only on what is new
Exposures already known stay in the list; you get an email only for new ones.
Your name on ransomware sites
Company name, brands and domains checked on leak sites, with the description in Italian or English.
Nobody has to go looking
The check runs by itself: weekly for credentials, daily for leak sites.
Two kinds of dark web monitoring, on the same page
Compromised credentials
On the email domains registered in the attack surface, the platform looks for credentials that have ended up in data breaches. For each match you see the email, username, password or hash, IP address, the name of the source breach and the date.
The check runs every week, on Tuesday morning; the Security Monitor contract provides for it weekly on one top-level domain. Comparison with the previous round generates the email about new exposures.
Leak and ransomware sites
Using your keywords, meaning company name, brands and domains, the platform reads the latest posts on the sites where ransomware groups publish their victims and the stolen data. The description of each post is available in Italian and English.
The check runs every night. If a source does not respond, earlier matches stay where they are: nothing is deleted because of a network error.
The risk is not just that one password
An exposed credential is a problem even after it has been changed. From one or two passwords an attacker can work out the pattern a person uses to create them, and apply it to their other accounts.
Anyone who has already suffered an exposure also becomes a preferred victim: for criminals they are a more vulnerable target, and therefore more exposed to new breaches. That is why the remedy we recommend in the reports is not just a password change, but the adoption of a password manager, which makes every credential different and impossible to deduce from the others.
A first-seen date that does not change
Each credential has a "new" badge and a first-seen date reconstructed from the archive, not from the latest scan. So that date does not shift with every check, and you can say precisely since when an exposure has been known: information that matters when you have to assess whether there has been a personal data breach.
Frequently asked questions about dark web monitoring
If we find an exposed password, have we been attacked?
Not necessarily. In most cases the credential comes from a breach of an external service the member of staff had signed up to with their work email. The name of the source breach helps you work this out.
What should we do about each match?
Have the password changed on the account involved and on any accounts where it may have been reused, and adopt a password manager. If the credential is recent, it is also worth checking the logins to the account in the period that followed.
What is dark web monitoring?
It is the continuous checking of the sources where stolen data circulates: archives of credentials from breaches and the sites where ransomware groups publish their victims. It lets you be the first to notice that a company password or the company's name has ended up there. What the dark web is.
What should you do if your company's name appears on a ransomware site?
It should be treated as a possible incident: you need to find out whether data was stolen and which, contain the situation and assess the notification obligations. Under the GDPR, a personal data breach that poses a risk to data subjects must be notified to the supervisory authority (in Italy, the Garante) within 72 hours of discovery. The Incident Response module guides you through the phases and assigns the actions.
Does dark web monitoring find every exposed credential?
No tool sees everything that circulates. The search runs on a very large archive of known breaches, so the absence of matches reduces the doubt but does not remove it. That is why the underlying remedy remains multi-factor authentication, which makes a stolen password much harder to use.
Which standards it supports
Monitoring exposed credentials documents identity management and threat surveillance, and helps you assess a possible data breach in good time.
Often activated together
Threat Intelligence
News and threats that concern your industry and your suppliers, gathered into a digest.
Learn more SeeMicrosoft Entra ID
The security posture of your Microsoft 365 tenant across 72 indicators, read-only.
Learn more SeeCyber Awareness
Simulated phishing campaigns prepared and run by Dottor Marc, with the results in the platform.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.