How monitoring works
1
Add monitors
Pick an email address, username or phone number — or, on Enterprise, a whole company domain — and add it as a monitor from your dashboard.
2
We check daily
Once a day, each monitor is compared with every record added to LeakCheck since its previous check.
3
Get the alert
A match goes to Telegram, email, Slack, Discord or your own webhook — wherever you chose — with the sites the new records came from.
Where alerts go
Pick any number of destinations on the monitoring page. Every one of them gets every alert.
Telegram
Link your account to our Telegram bot and get alerts as messages, with a button that opens the full lookup right in the bot.
To your account address, and to any other mailbox you add — a colleague's, a shared security inbox, a SIEM. Extra addresses confirm a link first, so nobody gets alerts they did not ask for.
Slack
Paste an incoming webhook URL and alerts land in the channel you chose, formatted with the monitored value, the sources and a link to the records.
Discord
A channel webhook is all it takes — create one in the channel's integrations, paste the URL, and every alert arrives as an embed.
Webhook
Your own HTTPS endpoint gets every alert as a signed JSON payload — the monitored value, the sources and the kinds of exposed data — ready for a SIEM or a ticketing system. Payload and signature
Test before you need it
Every Slack, Discord and webhook contact has a "Send test" that delivers a sample alert right away, so you can check the channel and the formatting without waiting for a real leak.
Alerts name the sources and the kinds of data exposed — never the leaked values themselves. Those stay in your dashboard, behind the link in every alert.
Domain monitoring for security teams
On the Enterprise plan, one monitor watches a whole company domain — both sides of it.
Your people's accounts, anywhere
Every new record that belongs to an email address of your domain, whichever breach it comes from — an employee reusing a work address on a site that got breached, a mailbox in a fresh combolist.
Logins to your sites, from anyone
Credentials that info-stealer malware captured on your sign-in pages — your own domain plus the extra hosts you list, such as sso.example.com or vpn.example.com — even when the account belongs to a customer or a contractor.
What a domain alert tells you
How many new records turned up, how many accounts they affect, how the records split between your domain's own accounts and stealer-log logins to your sites, the sources they come from and the most affected accounts — on Telegram, by email, in Slack or Discord, or as a JSON payload on your webhook. The records themselves are one search away in the dashboard.
Monitors on each plan
Every monitor watches one email address, username or phone number; an Enterprise domain monitor watches a whole company domain. See all plans.
