Help center
Dark web and breach exposure
Watch mailboxes for appearances in breach data, read what was exposed, and mark what you did about it.
Updated · 2 articles
A breach is the one risk you cannot discover by looking at your own systems. DomainGuard checks the addresses you name against a breach index (XposedOrNot), re-checks them on a schedule, and alerts you when a new breach lists one. DomainGuard sends each watched address to XposedOrNot to look it up, and stores only a hash and an encrypted copy.
Articles
- Mailbox exposure monitoring - adding an address, cadences, the limits per plan, manual checks, and how addresses are stored.
- Reading an exposure - source, date, data classes, how passwords were stored, the next action, and marking it reviewed.
Where
- iOS: the Exposure tab. This is the only screen for it; the web console has no dark-web page.
- API/MCP:
/api/darkweb/*; toolsget_dark_web_status,run_dark_web_scan,get_dark_web_breach,add_dark_web_email,remove_dark_web_email.
Plans at a glance
| Free | Starter | Pro | Enterprise | |
|---|---|---|---|---|
| Addresses watched | 1 | 5 | 10 | 50 |
| Scheduled re-checks (daily or weekly) | Yes | Yes | Yes | Yes |
| Manual checks | 1 a day | 5 a day | 10 a day | 50 a day |
| Push on a new hit | Yes | Yes | Yes | Yes |
What "exposure" means here
An exposure is a monitored address appearing in a dump the breach index knows about, with the breach's name, date and the classes of data it contained. It does not mean the mailbox itself was compromised; it means a service that held the address (and, often, a password used there) was. The next action is always the same shape: change the password anywhere it was reused, turn on two-factor on the mailbox, and expect phishing that quotes the leaked details.
What it is not
DomainGuard does not scan the dark web itself, buy dumps, or read mailboxes. It sends each watched address to a public breach index (XposedOrNot) to look it up, caches the answer for 24 hours, and stores only a hash and an encrypted copy of the address. "Nothing found" means the index has no record of the address, not that no breach exists.
XposedOrNot's results also carry infostealer logs: an address saved on a computer infected with password-stealing malware. Those show in the Exposure tab's Infostealer logs section and raise a "Password-stealing malware found" alert, because the malware takes live sessions as well as passwords.
Common questions
Can I watch a personal Gmail? Yes. Any address can be watched, up to the plan's limit. The one refusal is an address at a domain that another DomainGuard account tracks and this account does not; there, only the account's own verified sign-in address is allowed.
How does a hit reach me? On every plan it lands in the Alerts feed at once and reaches the app on any iPhone signed in to the account: with the morning summary on (the default), in the 8 a.m. summary push. We don't send breach alerts by email.
In reading order
Articles in Dark web
- Mailbox exposure monitoringAdd an address, choose a cadence, run a check now, and understand the plan limits, the upstream rate limit, and how addresses are stored.Updated
- Reading an exposureWhat an exposure detail shows (source, breach date, data classes, password storage), the plain next action, marking it reviewed, and asking for help.Updated
Still stuck?
Ask the people who run the scanner.
Send the domain and what you expected to see. We look at the same scan you are looking at and write back with what it means and what to change.