northgrid.example
All three sources.
A domain is checked on LeakIX, in the Have I Been Pwned breach directory and in certificate transparency logs.
LeakIX Have I Been Pwned Certificate transparency
Monitor
Watch the dark corners.
Monitor watches the domains and organisations you name in leak indexes, breach directories and certificate logs. It checks every day, and tells you when something new appears.
Watching
Select a target to filter.
Sources
LeakIXReady Have I Been PwnedReady Certificate transparencyReady
LeakIX keyStored in the Keychain
Ready to check
2 targets across 3 sources.
Exposures
Run a check to see what the indexes know.
Finding
Select an exposure to see what it is and what to do about it.
What to do
Two targets, three sources. Press Check now.
What it watches
Name what matters. Monitor does the looking.
A target is a domain or an organisation. Add the ones you run: the company domain, the domain your email lives on, the name your suppliers know you by.
Northgrid Energy
Searched by name on LeakIX.
An organisation is searched on LeakIX for leaks that name it. The breach directory and certificate logs are organised by domain, so they report Domains only.
LeakIX Have I Been Pwned Domains only Certificate transparency Domains only
Paste an address, keep the host
Paste a web address and Monitor keeps only the host, in lower case, without the scheme or the path. For example, https://Northgrid.example/login becomes northgrid.example. The same target is never added twice.
Three public sources
What the indexes already know.
Monitor reads three services that publish what has leaked, what has been breached and which certificates have been issued. Each answers a different question about the same name.
3public sources, and nothing else contacted
50LeakIX events read per target, at most
30days of certificates read from crt.sh
25newest hostnames kept per domain, wildcards excluded
| Source | What it finds | Targets | Access | What is read | Severity |
|---|---|---|---|---|---|
| Open databases, leaked data and exposed services tied to your domain or naming your organisation. | Domains and organisations | A free API key from leakix.net, kept in the Keychain on this device | Up to 50 events per target | LeakIX’s own rating. A leak never rates below Medium. | |
| Breaches that named your domain, with the kinds of data they exposed. | Domains | The public breach directory. No key. | Every breach listed for the domain | Critical over 10M accounts, High over 1M, otherwise Medium | |
| New hostnames, look-alikes and shadow IT, seen through the certificates issued for them. | Domains | Public certificate logs, through crt.sh. No key. | Certificates from the last 30 days. The 25 newest hostnames, wildcards excluded. | Info |
Severity
Four levels. Fixed rules.
Every finding carries one of four severities, set by a rule you can read rather than a score you have to trust.
- Info
New certificates, and exposed services LeakIX rates low. Something to recognise, not an alarm.
- Medium
Breaches of up to a million accounts, and what LeakIX rates Medium. A leak is never rated lower.
- High
Breaches over a million accounts, and what LeakIX rates High.
- Critical
Breaches over ten million accounts, and what LeakIX rates Critical.
Any High or Critical finding that is still open turns the summary to Needs attention.
Breach directory rule
Have I Been Pwned
HighOver 1M accounts
Drag, or use the arrow keys. The thresholds are the ones Monitor applies to every breach it reads.
Next steps
Every finding comes with what to do.
Each exposure opens with the same fixed advice for its source, the date the source recorded, a link to the record, and a way to acknowledge it once it is handled.
-
LeakIX An open database or an exposed service
What to do
- Confirm the host is yours.
- Take it off the internet, or put it behind authentication.
- Rotate any credentials it held.
- Check the logs for access before the index date.
Record on leakix.net
-
Have I Been Pwned A breach that named your domain
What to do
- Force a password reset for accounts on this domain.
- Enable two-factor authentication.
- Watch for credential-stuffing sign-ins in the following weeks.
Record on haveibeenpwned.com
-
Certificate transparency A certificate for a new hostname
What to do
- Ask whether anyone on your team requested it.
- If nobody did, treat the hostname as a look-alike or shadow IT.
- Investigate who controls it.
Record on crt.sh
Acknowledging closes a finding without forgetting it. It stays in the target’s history, keeps the date it was first seen, and stays closed when the next check reads it again.
How it behaves
It reads what the indexes already know. It never logs in anywhere.
Reads, never logs in
Monitor asks public services what they have recorded. It never signs in to anything, anywhere.
Hands off your systems
It never connects to your hosts, scans your ports or tests your defences. It never touches the systems it reports on.
Three services, named
leakix.net, haveibeenpwned.com and crt.sh. Nothing else is contacted, and every request says it comes from Vamocles.
Key in the Keychain
The LeakIX key is stored in the device Keychain, available on this device only, never in plain settings.
Results on the device
Targets and findings stay in the app’s own storage. On iPhone they are written with complete file protection.
Quiet by default
No noise for its own sake. A notification means something new appeared since the last check.
Asked before it watches.
Anything else, ask in a briefing. Request a briefing
Does Monitor search the dark web?
Not by crawling it. Monitor reads three public indexes that record what has already surfaced: LeakIX catalogues open databases, leaked data and exposed services; Have I Been Pwned lists breaches and the domains they named; certificate transparency records the certificates issued for each hostname. It does not visit hidden services, join forums or buy data.
Do I need an API key?
For LeakIX, yes: a free key from leakix.net, which Monitor keeps in the device Keychain. Have I Been Pwned’s breach directory and certificate transparency need no key. Without a LeakIX key, the other two sources still run and LeakIX reports Needs API key.
Why is an organisation checked on LeakIX only?
The breach directory and the certificate logs are organised by domain. LeakIX can also be searched by name, so an organisation target is searched there for leaks that mention it. Add the organisation’s domains as well to use all three sources.
How often does it check?
Whenever the last check is more than 20 hours old. On iPhone, Monitor asks iOS for a background refresh and the system chooses the moment. On the Mac, Vamocles looks every four hours while it is running. You can turn the daily check off, and press Check now whenever you like.
Will it alert me about the same thing twice?
No. A notification covers only what is new since the last check, with the count and the worst severity. Findings you acknowledge stay acknowledged when the next check reads them again, and remain in the target’s history.
Does Monitor scan our network or test our systems?
No. It never logs in anywhere, never connects to your hosts and never touches the systems it reports on. It asks three public services what they have already recorded about the names you gave it, and every request identifies itself as Vamocles.
Where are the results kept?
On the device. Targets, findings and the time of the last check are saved in the app’s own storage; on iPhone the file is written with complete file protection. The LeakIX key lives in the Keychain, on that device only.
Who is Monitor for, and how do we see it?
For operators of critical infrastructure, security teams and anyone who runs a domain. Monitor is part of the Vamocles apps, available in preview on iOS and macOS. Request a briefing and we will walk your team through it, or read about platform support.
Put your names under watch.
See Monitor with your own domains and organisations in mind, alongside Vanish, Vamo and the rest of the Cyber domain.
Or write to hello@vamocles.com