Dark web monitoring for businesses and MSSPs

THE DARKNET
OWNS YOUR Data?

INVESTIGATE NOW HERE

Trusted by > 200 MSSPs & > 100 EnterprisesMade in SwitzerlandHosting in Germany

01Partner dashboard

DARKNETSEARCHby KADUUPartner dashboardMSSP account

Alerts across clients · last 30 days

Clients29

Open alerts18

Monitored assets780

02Leaked credentials

DARKNETSEARCHby KADUULeaked credentials12 new

User · serverPasswordNoveltyRisk

it-ops@northwind.examplevpn.northwind.example••••••••10/1010/10

sales@northwind.examplecrm.northwind.example••••••••9/109/10

hr@northwind.examplesso.northwind.example••••••••9/108/10

finance@northwind.examplemail.northwind.example••••••••7/109/10

Credentials214

New12

Critical5

03Stealer logs

DARKNETSEARCHby KADUUStealer logsNew log

LAPTOP-NW-0427Windows 11 · 203.0.113.42Infected 3 weeks agoLog found 2 days agoNorthwind logins in this log

Passwords142

Cookies640

Tokens6

04Attack surface

DARKNETSEARCHby KADUUAttack surface3 known exploited

vpn.northwind.example198.51.100.24443KEV

dev.northwind.example198.51.100.31228080CVE

mail.northwind.example203.0.113.925587

Hosts38

Open ports12

Known exploited3

05Lookalike domains

DARKNETSEARCHby KADUULookalike domains1 phishing

northwlnd.exampleHomoglyphActivePhishing

north-wind.exampleHyphenationParked

nortwind.exampleOmissionRegistered

northwind-login.exampleAdded wordTaken down

Lookalikes41

Active6

Taken down3

06Darknet chatter

DARKNETSEARCHby KADUUDarknet chatter2 new

Forum2 h agoNorthwind

TelegramyesterdayNorthwind

Market4 days agoNorthwind

Mentions7

Sources3

New2

07Code exposure

DARKNETSEARCHby KADUUCode exposurePublic repository

northwind-infra-example / .env.backuppushed 5 days ago

1APP_ENV=production

2NORTHWIND_DB_URL=[redacted]Risk 10/10

3SMTP_PASSWORD=[redacted]

4API_TOKEN=••••••••

5LOG_LEVEL=warn

Secrets4

Repositories2

Risk10/10

08Credential reports

DARKNETSEARCHby KADUUCredential reportsReport ready

New credentials per month

Compared domains

northwind.example46

nw-logistics.example21

northwind-shop.example9

Domains3

New credentials76

Trend−18%

01 / 08Partner dashboard

Every client in one partner account: alerts, assets and reports at a glance.

Explore Partner dashboard

Partner dashboard: Every client in one partner account: alerts, assets and reports at a glance. Explore Partner dashboard
Leaked credentials: Leaked logins for your domains, scored for novelty and risk. Explore Leaked credentials
Stealer logs: Infected machines with your logins, cookies and session tokens. Explore Stealer logs
Attack surface: Your hosts, open ports and known exploited vulnerabilities. Explore Attack surface
Lookalike domains: Lookalike domains of your brand, from registration to takedown. Explore Lookalike domains
Darknet chatter: Mentions of your company on forums, Telegram channels and markets. Explore Darknet chatter
Code exposure: Secrets from your company found in public code repositories.
Credential reports: Monthly credential reports that compare your domains. Explore Credential reports

Let our clients
speak for us

Gartner Peer Insights

“Kaduu is a very powerful platform with a lot of exclusive data on credential leaks and info stealers. Their technical team and support staff are also here to assist you.”

Software Technical Lead · IT Services · <50M USD · Aug 2025 · Read the review

Darkweb Monitoring

Discover an Effective and Affordable Darknet Threat Intelligence Solution

We watch dark web markets, Telegram, paste sites, botnet logs and more, and alert you the moment your data turns up. New to the topic? Read how dark web monitoring works.

01 / 07

Data Breach Detection

Every kind of leak in one search, with the original record.

Monitoring

northwind.exampleLeaks

Leaks10+4
Matching records1,633+212
Sources6

NewRansomware leak, files of a supplier38 files matchRansomware leakyesterday8/10
Open Elasticsearch index with CRM leads1,406 documents matchOpen database1 week ago8/10
Logistics SaaS database dump212 rows matchDatabase dump2 weeks ago7/10

Explore

430,764,510,204leaked records, live
6leak sources in one search

Threat visibility

Continuous threat visibility

Leaks, stealer logs, attack surface and threat chatter, watched in one platform.

Explore the platform

What our clients say

Security teams, MSSPs and NGOs use DarknetSearch every day.

See all success stories

Cloud y Olé uses DarknetSearch to detect client data leaks, exposed assets and domain spoofing in real time.
Salvador MadridChief Technology Officer, Cloud y Olé
Read the case study
Bühler, a major Swiss industrial company, detects leaked credentials, exposed assets and data breaches across the dark web.
Patrick ZimmermannExpert Information Security Specialist, Bühler
Read the case study
The CyberPeace Institute monitors the dark web for leaks, exposed credentials and data about the NGOs it supports.
Fabien LeimgruberHead of Cyber Resilience, CyberPeace Institute
Read the case study

Trusted by

Who uses DarknetSearch

Built for every team that needs external cyber visibility

In-house security teams, service providers and external advisors use DarknetSearch, each for their own questions.

Explore all use cases

In-house security
CISOs and security leaders
Typical roles:
- CISO
- Security manager
- Risk officer
Why they use it:
Track leaked credentials, exposed assets and dark web mentions of your company, and turn the findings into clear risk reports.
See the CISO use case
Service providers
MSSPs and MDR providers
Typical roles:
- Partner owner
- SOC lead
- Analyst
Why they use it:
Watch every client’s domains, people and brands, work the alerts in your SOC and report under your own name.
Run it for your clients
Threat operations
SOC teams
Typical roles:
- SOC analyst
- CTI analyst
- Threat hunter
Why they use it:
Check a user, host or domain against leaks and stealer logs during triage, and push monitor matches into the SIEM by webhook.
See the SOC use case
Technology partners
Security vendors and OEM
Typical roles:
- Product manager
- Developer
Why they use it:
Use our leaked-credential, stealer-log and darknet data inside your own platform, fully white-label.
Read the API docs
Offensive security
Penetration testers and red teams
Typical roles:
- Pentester
- Red team lead
Why they use it:
Find exposed credentials, hosts, code and staff data before an engagement, to scope it and to show impact.
Map an attack surface
Incident response
Incident response and forensics
Typical roles:
- IR lead
- Forensic analyst
Why they use it:
See which credentials, files and mentions of a victim appear on leak sites, ransomware blogs, Telegram and forums.
Check what leaked
Insurance
Cyber insurers and brokers
Typical roles:
- Underwriter
- Broker
- Risk engineer
Why they use it:
Check applicants and the portfolio for leaked credentials, stealer infections and exposed services, also between renewals.
See the insurance use case
Advisory
Consultancies, vCISOs and auditors
Typical roles:
- Consultant
- vCISO
- Auditor
Why they use it:
Add a dark web and attack surface chapter to assessments and audits, with reports that carry your logo.
Become a partner
Service providers
MSPs and IT service providers
Typical roles:
- Account manager
- IT administrator
Why they use it:
Bundle credential and stealer-log monitoring with your IT contracts, and alert clients when one of their passwords shows up.
Monitor stealer logs
Service providers
Telcos, hosting and cloud providers
Typical roles:
- Product manager
- Partner manager
Why they use it:
Package monitoring for many small business customers, in client workspaces or through the API in your own portal.
Offer it to your customers
Risk management
Third-party risk and ratings
Typical roles:
- Vendor risk manager
- TPRM analyst
Why they use it:
Monitor vendors and partners for breaches, stealer infections and ransomware listings, and feed the signal into your risk scores.
Watch your suppliers
Due diligence
M&A and investor due diligence
Typical roles:
- Deal team
- Investor
- Advisor
Why they use it:
Run a dark web and attack surface review of an acquisition target or a portfolio company before you sign.
Start a free trial
Public sector
CERTs, ISACs and public sector
Typical roles:
- CERT analyst
- ISAC coordinator
Why they use it:
Monitor member organisations and notify those affected by new leaks or stealer infections.
Track stealer infections

What sets us apart

Continuous Monitoring Of Open, Deep And Dark Web Sources To Identify Threats

DarknetSearch detects the digital risks organizations care about, with a broad data collection and a proven threat model that adapts to your profile.

Broad data coverageLeaks, credentials, stealer logs and more.
Updated around the clockNew leaks are added every day.
Actionable intelligenceClear results to prioritize and reduce risk.

Leak Lists

Daily intake and what the collection holds, from the same source as our platform.

Live data from DarknetSearch

Leak lists134,684+278 today
Records430.7B+625.8M today
Data volume37.39 TB+69.53 GB today
Accounts295.9B+451.9M today

Stay ahead of emerging threats

Get the latest dark web insights, data breaches and threat updates straight to your inbox.