Dark web
Whole-domain breach monitoring
Watch every mailbox at a domain, not just the ones you name. Needs scan clearance and the paid breach index; the waitlist while a domain is being enabled.
Updated · 2 min read
Naming addresses one at a time misses the mailbox nobody remembered. Whole-domain monitoring asks the breach index for every address at a domain and lists the ones that appear.
Requirements
- The domain must be cleared for active scanning on the account (scan clearance); the same proof the vulnerability scanner uses, because the answer reveals other people's addresses at the domain.
- The breach index has to have the domain verified on its side. That verification is a manual step at the provider with no API, so a domain can sit on a waitlist until it is enabled.
Where
- Web: Security, Dark web, Domain monitors.
- iOS: Exposure, Email alerts, "Whole-domain watching", reachable when the account can use it. The screen says when it cannot.
- API/MCP:
GET/POST /api/darkweb/domains,POST /api/darkweb/domains/scan,DELETE /api/darkweb/domains/:id,GET/PUT /api/darkweb/domain-waitlist; toolslist_dark_web_domain_monitors,add_dark_web_domain_monitor,run_dark_web_domain_scan,remove_dark_web_domain_monitor.
What you get
For each monitored domain: the latest scan state, the number of addresses seen in breach data, and the breaches involved, in the same format as an individual exposure. Addresses discovered this way are shown masked and can be added as individually monitored mailboxes if you want per-address alerts and cadence.
Common questions
I am on the waitlist. How long? Until the provider verification is done for that domain. The status endpoint reports when it flips, and the app's Email alerts screen updates.
Does this count against my address limit? No. The per-address limit (1 / 5 / 10 / 50) applies to individually monitored mailboxes.
Privacy
Addresses discovered by a whole-domain scan belong to other people at your organisation. They are shown masked, stored as hashes like any monitored address, and never included in push payloads or audit entries in the clear. Because the answer reveals who at the domain appears in breach data, the feature is behind the same ownership proof as the active scanners: you can only see it for a domain you have proven you control.
When to use it
Turn it on for the domains staff sign up to services with. Individually monitored addresses are for the mailboxes that matter most (the owner, the bookkeeper, the admin@ alias); whole-domain monitoring is the safety net under them.
Keep reading
Related articles
- Scan clearance and ownership proofProve you control one domain on the account (DNS record, file, or an email link) and every domain is cleared for 90 days. Protected targets and authorisation.Vulnerabilities and exposure ·Updated
- Hosts and open portsEvery host a scan found, grouped by domain, with its services named by what the port means; the 128-port list; and why an empty list is not an all-clear.Vulnerabilities and exposure ·Updated
- Mailbox exposure monitoringAdd an address at your own domain, choose a cadence, run a check now, and understand the plan limits, the upstream rate limit, and hashed storage.Dark web ·Updated