Skip to main content

How dark-web monitoring works

Umbra's exposure data comes from a third-party reputation feed — a continuously ingested corpus of breach dumps, combolists, and infostealer logs (the credential files exfiltrated by malware from infected machines and traded on the dark web). Umbra proxies the feed server-side: your browser never talks to the vendor, and vendor credentials never leave Umbra's backend.

The monitoring loop​

  1. Your domain is registered with the reputation feed for monitoring (automatic for your email domain; via the DNS-TXT wizard for additional domains).
  2. When the feed detects a new exposure for a monitored domain, it pushes the detection to Umbra.
  3. Umbra stores the record and raises an alert — the in-console bell, and whatever channels your notification rules route to.
  4. The record appears in Exposures; the alert appears in the Alerts feed and the bell.

The very first registration additionally triggers a retrospective import of everything the feed already holds — see the first scan.

Two dates, two facts​

Exposure records carry two timestamps that mean different things, and Umbra shows both:

  • When it happened — the capture or breach date: when the malware ran, or when the breached data is from.
  • When it was detected — when the reputation feed found and indexed it.

A credential stolen a year ago can be detected today, the day its stealer log finally surfaced for sale. Fresh detections of old captures are still fresh news — that is exactly what monitoring is for.

Counters: exact, or N+​

Some of the feed's lists are capped by pagination (for example, a per-identity risk profile lists at most 100 records). Where Umbra cannot know the exact total, the counter shows the maximum it has seen with a trailing + — 100+ means at least 100, not exactly 100. A counter without a + is exact.

Coverage is per-index​

The reputation feed serves different record types from separate indices with independent coverage. In practice:

  • An infection reported by an identity's risk profile can have no stealer log in the searchable corpus (yet). Its device page then shows "Infection — metadata only" — the dates and infostealer id the feed does report — rather than pretending nothing exists.
  • A device can have captured credentials but no machine fingerprint; the page says so in place of the dossier.
  • Feeds are ingested continuously, so an infection can gain its stealer log later.

Umbra's UI is built to keep "empty" and "unknown" apart: it never renders "not found" for "the lookup did not come back".

What Free sees​

On the Free plan, exposure data is served with a 30-day delay and password fragments stay masked; fresh detections appear only as counters, and no alerts are sent at all. The plans page has the full matrix.