Risk score
Public aggregateA prioritization signal derived from the domain's overall exposure pattern.
FemtoSec Security DeskPublic domain preview
Check your domain for data breaches and dark web exposure.
Check your domain for leaked credentials, exposed employees, infostealer activity, and historical dark web exposure. Start with a free risk preview, then escalate to a confidential report when the signal warrants it.
01 / Initiate scan
Run a free domain breach scan
No account required. The browser preview stays aggregate-only and never exposes raw credentials or employee identities.
02 / Public telemetry
Six browser-safe signals. One clear first look.
The public preview is deliberately concise: enough context to prioritize investigation without exposing sensitive source records in a browser session. v2 goes deeper only after an authorized report request.
Total exposures
Public aggregateThe aggregate number of matched exposure records tied to the submitted domain.
Exposed employees
Public aggregateA summary count of employee-linked identities represented in the exposure set.
Unique credentials
Public aggregateThe number of distinct credential records identified for the domain.
Active threats · 90 days
Public aggregateA recent-activity signal from the last 90 days, not the full boundary of the report scope.
Plaintext password risk
Public aggregateThe percentage signal for exposures associated with plaintext password findings.
03 / Extended report scope
More than a 90-day domain breach scan.
The Active Threats (90d) metric remains a recency signal in the free preview. The confidential report can extend far beyond that window when historical dark web evidence exists for the domain.
Section availability depends on the evidence actually tied to the organization. Not every domain will populate every report group.
Historical exposure
More than a 90-day signal
The 90-day metric in the public preview is only a recency indicator. The confidential report can include broader historical exposure timelines and source distribution when evidence exists for the domain.
Identity impact
Compromised employees and credentials
Authorized teams can investigate exposed employee identities, credential counts, and credential-linked patterns without exposing those raw records in the browser preview.
Threat intelligence
Infostealers, markets, and breaches
The report can correlate infostealer activity, market listings, breach references, and other underground signals tied to the domain footprint.
Third-party exposure
SaaS, shadow IT, and repositories
Where signals exist, the report can surface third-party services, cloud identity exposure, shadow IT indicators, and code-repository references associated with the organization.
Credential hygiene
Password strength and reuse patterns
Beyond counts alone, the report can highlight password-strength trends, reuse indicators, and other credential-quality patterns that affect remediation priority.
Infrastructure context
Victim machine and network context
Some domains produce device, IP, ASN, organization, or geography context that helps investigators understand how the exposure set is distributed.
Open-source signals
Telegram and web mentions
The report can capture relevant Telegram and web references when those signals are present in the source evidence linked to the domain.
Remediation
Prioritized actions for authorized teams
The final output is designed to help security and IT teams decide what to reset, monitor, validate, and escalate next based on the domain's actual exposure pattern.
04 / Triage workflow
Scan, understand, and act.
Treat the public preview as an entry point, then use the exposure pattern to decide whether you need a confidential report, tighter identity controls, or ongoing monitoring.
Scan
Submit the primary organizational domain for a free domain breach check.
Understand
Review risk score, exposure volume, identity impact, and the 90-day recency signal.
Act
Escalate to the confidential report or continuous monitoring when the exposure pattern warrants follow-through.
Domain breach scanner frequently asked questions
Domain breach scan questions, answered
Clear answers about the free preview, 90-day telemetry, confidential report scope, privacy, and next steps.
What does the free domain breach preview include?
What does the free domain breach preview include?
The public preview includes a risk score, total exposures, exposed employee count, unique credential count, active threats observed in the last 90 days, and the plaintext password percentage. It stays aggregate-only and does not expose raw credentials or employee identities in the browser.
Is this scanner limited to the last 90 days?
Is this scanner limited to the last 90 days?
No. The 90-day metric is one recent-activity signal in the public preview. The confidential report can include broader historical dark web exposure and timeline context when the domain has that evidence.
What can the confidential report include beyond the public preview?
What can the confidential report include beyond the public preview?
Depending on the signals tied to the domain, the confidential report can include compromised employee and credential patterns, infostealer and market signals, public breach references, third-party exposure, password hygiene trends, network context, and prioritized remediation actions.
Does the public preview reveal passwords or employee details?
Does the public preview reveal passwords or employee details?
No. The public preview returns aggregate exposure metrics, including the plaintext password percentage, without displaying raw passwords, credential values, or employee identities.
How quickly will the scan finish?
How quickly will the scan finish?
The scan begins immediately, and most public previews are ready in seconds. Exact processing time varies with domain footprint and whether a recent report is already available for reuse.
Does every confidential report include every section?
Does every confidential report include every section?
No. Report sections depend on the signals actually tied to the domain. Organizations with limited evidence may have fewer populated sections than domains with broader exposure across multiple sources.
Who should use this scanner?
Who should use this scanner?
CISOs, IT managers, security analysts, compliance teams, and identity owners that need a fast domain breach check before they escalate to deeper investigation or continuous monitoring.