Of the 33 features in this comparison, ZeroFox’s public website states 23 and 3 in part; we did not find 7. Every cell links to its source.
Ownership: Haveli Investments completed its acquisition of ZeroFox in May 2024; ZeroFox shares are no longer listed on Nasdaq. Source
On our list of 33 features
The list comes from DarknetSearch’s own feature pages, so it is built around what we do. What ZeroFox offers outside it is listed further down.
DarknetSearch, made in Switzerland by Kaduu, collects leaked data, full stealer logs and underground chatter, and lets you search, monitor and report on all of it in one place. Attack surface discovery, code exposure and domain spoofing detection with takedowns sit in the same workspace, and every feature comes with an API and webhooks.
ZeroFox describes an external cybersecurity platform for threat intelligence, digital risk protection (brand, domains, social media, executives), attack surface intelligence and physical security intelligence. It works in a cycle of discovering threats, validating them with AI and analysts, and disrupting them through takedowns.
Paraphrased from zerofox.com
| Feature | DarknetSearch as of 6 Nov 2026, 17:30 UTC | ZeroFox reviewed 6 Nov 2026, 17:36 UTC |
|---|---|---|
| Breach databases and SQL dumps | Yes SQL dumps, documents, configuration files and logs, with the original content. Our page | |
| Combo lists and URL:login:password lists | Yes De-duplicated, with an estimate of how much of a combo list is invalid. Our page | |
| Stealer logs per infected computer | Yes The whole log per computer: passwords, cookies, tokens, autofill, files and system details. Our page | Partial Credentials from stealer logs; no per-device context stated. |
| Session cookies and tokens from infostealers | Yes Cookies and tokens shown with the infected computer they came from. Our page | Not found Not found on zerofox.com. |
| Paste sites | Yes Paste sites, where configurations and samples often appear first. Our page | Yes |
| Open cloud storage and databases | Yes Misconfigured S3 and Azure storage and open databases. Our page | Partial Cloud posture; open buckets/databases not named. |
| Payment card data | Yes Cards shared for free and cards offered for sale, by BIN or holder. Our page |
| Feature | DarknetSearch as of 6 Nov 2026, 17:30 UTC | ZeroFox reviewed 6 Nov 2026, 17:36 UTC |
|---|---|---|
| Telegram channels | Yes 2,200+ cybercrime channels, mostly private and invite-only. Our page | Yes |
| Discord servers | Yes Servers where tools, logs and leaks are shared. Our page | Yes |
| Dark web and hacker forums | Yes Forum threads re-checked for new replies, and a live search of 50+ hacker forums. Our page | Yes Source: zerofox.com · |
| Data for sale: markets and broker listings | Yes What is for sale, which kind of data and when it was listed, plus stealer markets. Our page | Yes |
| Ransomware leak sites | Yes Victim posts, and the logins and file tree from the leaked archives. Our page | Yes |
| Feature | DarknetSearch as of 6 Nov 2026, 17:30 UTC | ZeroFox reviewed 6 Nov 2026, 17:36 UTC |
|---|---|---|
| Code and secrets in public repositories | Yes GitHub, GitLab, Gists, Postman and Google dorking across 50+ sites, scored 0 to 10. Our page | |
| Attack surface discovery from a domain | Yes Passive discovery from one domain, 17 subdomain sources, CVE matching with CISA KEV context. Our page | Yes Prioritisation with EPSS, CVSS, CISA KEV. |
| Executive and VIP exposure | Yes VIP and executive exposure analysis in the attack surface assessment. Our page | Yes |
| Credential check at sign-up and login | Yes A credential check for sign-up and login, through the API. Our page | Not found Not found on zerofox.com. |
| Feature | DarknetSearch as of 6 Nov 2026, 17:30 UTC | ZeroFox reviewed 6 Nov 2026, 17:36 UTC |
|---|---|---|
| Lookalike domain detection | Yes 45+ permutation algorithms plus new registrations; 14 monitors per lookalike. Our page | Yes |
| Takedowns of phishing and lookalike sites | Yes Included in the plan. An analyst follows every request; the engine comes from our sister company SpoofGuard. Our page | |
| App store impersonation | Yes Spoofed apps that use your name. Our page | |
| Certificate transparency monitoring | Yes New certificates for your names, from certificate transparency logs. Our page | Yes |
| Feature | DarknetSearch as of 6 Nov 2026, 17:30 UTC | ZeroFox reviewed 6 Nov 2026, 17:36 UTC |
|---|---|---|
| Continuous monitoring with alerts | Yes Monitors per source, by email with your own sender and template, or by webhook. Our page | Yes |
| REST API | Yes Every feature has a documented API, and every search can be copied as an API call. Not in the Starter plan. Our page | Yes Source: zerofox.com/platform/integrations/ · |
| Webhooks | Yes Monitors push matches as JSON to your own systems. Our page | Yes Source: zerofox.com/platform/integrations/ · |
| MCP server for AI assistants | Yes Read-only by default; anything that spends quota needs your explicit yes. Our page | Not found Not found on zerofox.com. |
| SIEM, SOAR and ticketing integrations | Partial Through webhooks and the REST API; our pages name no native connectors. Our page | Yes Also Splunk, Sentinel, Cortex XSOAR, ServiceNow, syslog. Source: zerofox.com/platform/integrations/ · |
| Exports and reports | Yes JSON, CSV or XLSX exports; white-label PDF reports in five languages. Our page |
| Feature | DarknetSearch as of 6 Nov 2026, 17:30 UTC | ZeroFox reviewed 6 Nov 2026, 17:36 UTC |
|---|---|---|
| Multi-tenant client workspaces | Yes One workspace per client, with its own users, assets, plan, allowances and API tokens. Our page | Yes Source: zerofox.com/partners/mssp/ · |
| White-label app and reports | Yes Your logo, domain, colours and look in the app, and your brand on every report. Our page | Partial MSSP co-branding; full white label via OEM programme (social media security). Source: zerofox.com/partners/mssp/ · |
| MSSP and reseller programme | Yes Run the service for clients, resell client workspaces, or both. Our page |
| Feature | DarknetSearch as of 6 Nov 2026, 17:30 UTC | ZeroFox reviewed 6 Nov 2026, 17:36 UTC |
|---|---|---|
| No search history kept | Yes Not in the app, not in server or API logs. Code exposure scans keep a history by design. Our page | Not found Not found on zerofox.com. |
| Customer data hosted in the EU | Yes Hosted in Germany. Our page | Not found Not found on zerofox.com. |
| Feature | DarknetSearch as of 6 Nov 2026, 17:30 UTC | ZeroFox reviewed 6 Nov 2026, 17:36 UTC |
|---|---|---|
| Free trial | Yes 7-day free trial. Our page | Not found Not found on zerofox.com. |
| Public price list | Yes End-client list prices on the pricing page; MSSP editions on request. Our page | Not found Not found on zerofox.com. |
Offered on ZeroFox’s website and not part of our feature list, or stated more fully than ours.
Features we offer that we could not find, or found only in part, on ZeroFox’s public website. That does not mean ZeroFox lacks them.
The mark shows what we found on ZeroFox’s website. Each item links to our page that describes it.
Start a free trial, check the public price list, or book a demo with our team.
