Dark web
Mailbox exposure monitoring
Add an address at your own domain, choose a cadence, run a check now, and understand the plan limits, the upstream rate limit, and hashed storage.
Updated · 2 min read
Adding an address
- Web: Security, Dark web, Add address.
- iOS: Exposure, the plus button at the top or Watch a mailbox in the list. The sheet offers the cadences the plan allows.
- API/MCP:
POST /api/darkweb/emailswith{ email, cadence }; tooladd_dark_web_email.
An address must be at one of the account's own domains, or be the account's verified sign-in address. That rule exists so the feature watches your mailboxes, not someone else's.
Cadence
| Cadence | Meaning |
|---|---|
| Manual | Checked only when you press Run check now |
| Weekly | Re-checked when the last check is more than 7 days old |
| Daily | Re-checked when the last check is more than a day old |
Scheduled re-checks are included on every plan, Free included; Free's limit is the number of addresses (one), not the cadence. In the app a mailbox on a manual cadence reads "This mailbox: manual · daily available on Free".
Limits
| Plan | Addresses | Manual checks per day |
|---|---|---|
| Free | 1 | 1 |
| Starter | 5 | 5 |
| Pro | 10 | 10 |
| Enterprise | 50 | 50 |
Run check now (POST /api/darkweb/scan, tool run_dark_web_scan) refreshes every monitored address. When the day's allowance is used the button shows the server's own message with the reset time; existing results stay readable.
How a check works
The address is looked up in the XposedOrNot breach index. Results are cached for 24 hours and shared between accounts watching the same address, and the scheduled sweep spends a bounded number of upstream calls per hour (a paid index key lifts the cap). If the upstream refuses, the sweep stops for that tick and resumes on the next; nothing is recorded as "clear" because of a rate limit.
Storage and privacy
An address is stored as a SHA-256 hash plus an encrypted copy that only the re-check can decrypt. Audit entries and push payloads carry the hash or a masked form (jo***@example.com), never the address. Removing an address (DELETE /api/darkweb/emails/:hash, swipe in the app) deletes both.
What is shown
- Last check card: when it ran, how many exposures are waiting on you, and the cadence the watched mailboxes actually carry.
- New and Reviewed exposures, grouped under the address they were found on, each row leading with the breach and when it happened.
- Watched mailboxes grouped by domain with cadence and last check.
Alerts
A new breach listing a monitored address pushes to the app on every plan (Dark web hit). Email delivery is under Exposure, Email alerts (PUT /api/darkweb/delivery, tool update_dark_web_alert_delivery) and needs a paid plan.
Common questions
Can I watch my personal Gmail? Only if it is the account's sign-in address. Otherwise the address must be at a domain on the account.
A breach from 2016 showed up as new. New to this account: the address had not been checked before. Mark it reviewed once you have confirmed the password was changed since.
Keep reading
Related articles
- Whole-domain breach monitoringWatch every mailbox at a domain, not just the ones you name. Needs scan clearance and the paid breach index; the waitlist while a domain is being enabled.Dark web ·Updated
- The domain setup guideThe per-domain checklist computed from what is actually set up: first check, alerts, email records, DMARC reports, ownership proof, monitoring and more.Getting started ·Updated
- Custom endpoint checksSaved URL checks that poll a specific page or API on a schedule with their own run history, plus the one-off probe. Limits: 30 checks, 60 probe runs an hour.Alerts ·Updated