Is your domain already
in stealer logs?
Enter your domain. We check dark web markets for infected devices and stolen sessions tied to it.
The scanner didn’t load.
Open it directly, or book a demo and we’ll run the check with you.
A snapshot of your exposure
Aggregated results for your domain, in about a minute. Enough to know whether you have a problem, without exposing anyone.
- Infected devicesHow many devices tied to your domain appear in stealer logs, split into employee and user devices.
- Per device: OS, malware family and dateEnough to see how recent and how widespread the infections are.
- Most compromised URLsWhich of your login pages, portals and services show up in the stolen data.
The chain you interrupt
A device in stealer logs is step two of an attack. The scan shows it before an attacker buys the session.
- Device infected An employee or contractor device, often unmanaged, runs a stealer.
- Log listed for sale Credentials and session tokens appear on a criminal marketplace.
- Passguard detects it here The listing is matched to your domain. Your team gets the alert, with the sessions to revoke.
- Attacker buys the session Valid tokens are bought within hours of listing.
- Logs in as your employee MFA bypassed. The stolen session walks straight into your systems.
Hundreds of organisations are safer with Passguard
“Passguard is pragmatic, no‑nonsense, and free from FUD.”
Is the free scan safe to run?
Yes. We only look up your domain in data we already hold from criminal marketplaces. Nothing touches your systems, and we never store credentials from the scan.
What exactly is checked?
Stealer logs and marketplace listings that mention your domain: infected devices, the malware family involved, and which of your services have stolen session tokens for sale.
How long does it take?
Usually under a minute. Larger domains with many matches can take a little longer while we group the results.
What if the scan finds something?
You see how many devices and sessions are exposed. Passguard monitoring gives you the details (users, services, timeline) so you can revoke sessions and reset access. Book a demo and we walk through it with you.
Why can’t I see the full details in the free scan?
The details identify real people at your organisation. We only release them inside a verified Passguard account, after you have proven ownership of the domain.
Is this the same as monitoring?
No. The scan is a one-off snapshot. Monitoring alerts you the moment a new infection tied to your domain appears, 24/7.
Can I scan a domain I don’t own?
The free scan only shows aggregated results: how many devices are affected, when, and which URLs. It never shows credentials or sessions, so a scan of another domain reveals nothing sensitive. Full details in the platform require domain verification by email or DNS.
Do you store the domains that are scanned?
We log the scanned domain and a timestamp to prevent abuse and to see how the scan is used. We do not build profiles, share the list or contact you because of a scan. Details are in the privacy statement.
