Dark Web Scanning: What It Finds and What to Do Next

A dark web scan checks whether your personal information, such as an email address, a password, a phone number or a Social Security number, appears in data that criminals have leaked, traded or sold. It is a detection tool, not a shield. It tells you that something has already escaped, so that you can act before someone uses it. This guide explains how scans work, what they can and cannot tell you, how a one-time scan differs from continuous monitoring, and what to do the moment a result comes back positive.

TL;DR

• A dark web scan matches your identifiers (email, domain, and so on) against known leaked and traded data. It is reactive: it finds exposure that has already happened.
• A positive result means you should change passwords (email first), turn on multi-factor authentication and watch your accounts. It does not mean you were hacked today.
• One-time scans are a snapshot. Monitoring repeats the check and alerts you when new exposure appears.
• Never click links in an alert email. Go to the provider’s site directly.
• Looking at the dark web is not illegal in itself. Crimes committed there are still prosecuted.

What a dark web scan actually does

The dark web is a part of the internet reachable only with special software. It is used for privacy, and it is also where stolen data is traded. A scanner does not wander around on your behalf looking for “you.” It works the other way round. You supply an identifier, and the service searches the collections of leaked records, breach dumps and criminal forums it has access to for matches.

That has three practical consequences.

1. A scan only knows what its provider has collected. No service sees every forum, channel or private sale. A clean result means “not found in what we can see,” not “safe.”
2. The scan matches what you type. If you scan one email address, you learn about that address. Your other emails, your phone number and your domain need their own checks.
3. The result describes the past. The data leaked at some earlier date. The scan tells you it is now findable.

The companies that crawl the web at scale make the same point about how this works: automated crawlers collect pages continuously, and detection depends on what the crawler can reach. Microsoft, for example, describes its web crawl as covering billions of requests daily, and still no crawler claims total coverage of criminal spaces.

What can show up in a result

Typical findings fall into a few groups:

• Credentials: email and password pairs from breached websites.
• Personal identifiers: names, dates of birth, phone numbers, addresses.
• Sensitive identifiers: Social Security numbers or bank and card details, when a scanner supports checking them.
• Organizational data: employee logins and company domains in credential dumps.

The type of exposure decides how urgent your response is. A leaked password for a forum you abandoned in 2014 matters much less than a password you still use at work.

One-time scan versus continuous monitoring

People use “scanning” and “monitoring” as if they were the same. They are not, and the difference matters for what you buy or use.

A free scan is a sensible first step. You will learn whether you have an obvious problem. But exposure is not a one-off event. New breaches happen constantly, and your data can appear again months after a clean scan. If you want to know about it quickly, you need something that keeps looking.

You can try both approaches with us. Our dark web email scan checks an individual address, and the dark web domain scan is built for organizations that want to see whether company addresses appear in exposed data.

What a scan cannot do

The biggest misunderstanding about dark web scanning is that it prevents breaches. It does not. By the time a credential is listed somewhere, the breach that exposed it has already occurred. CISA’s #StopRansomware guide treats dark web monitoring as part of credential defense: its value is that it lets an organization respond quickly with password resets and multi-factor authentication before an intruder turns a stolen login into a full compromise.

So think of an alert as a smoke detector, not a fireproof wall. Specifically, a scan cannot:

• Remove your data. Once records are circulating, nobody can reliably pull them back.
• Guarantee coverage. Private sales and closed groups may be out of reach.
• Tell you who has your data or what they will do with it. You learn that it exists, not its intended use.
• Replace good habits. Unique passwords and multi-factor authentication limit the damage of any single leak.

That last point is why scanning works best together with a password manager and strong sign-in methods. The scan tells you what leaked. The manager and MFA reduce what a leak can cost you.

Why organizations care more than ever

For businesses, stolen credentials are not an abstract risk. The U.S. Department of Justice describes the dark web as a main marketplace for the ransomware economy, where affiliates buy access and communicate anonymously. Valid logins are a cheap way in, which is why a single reused password on a work account can matter more than a sophisticated exploit.

For a company, a useful monitoring setup answers these questions:

• Do any employee addresses on our domain appear in leaked data?
• Are the leaked passwords ones that could still work?
• Can we force resets and require MFA quickly?
• Who owns the response, and how fast do they act?

We cover the business case in more detail in the benefits of dark web monitoring for businesses, and our Weak Password Cost Report looks at what poor password hygiene can cost.

What to do if your information shows up

A positive result is stressful, but the response is mostly routine. Work through it in order.

1. Change the email password first. The FTC advises that email is the key to recovering most other accounts, so securing your email account comes first when you learn your information is for sale.
2. Change any password that matches the leaked one. If you reused it elsewhere, change it everywhere. Use a different, long password for each account.
3. Turn on multi-factor authentication. The FTC calls two-factor authentication the best way to protect your accounts, beyond a strong password.
4. Check what was exposed. The FTC’s data breach guidance tells you to find out which information was involved and to act on that. A leaked password calls for different steps than a leaked Social Security number.
5. If sensitive identifiers leaked, protect your credit. The FTC’s identity theft recovery advice includes placing a fraud alert and getting your credit reports, and freezing your credit if you have not already.
6. Watch for misuse. Review bank and card statements and credit reports for activity you do not recognize.

For a step-by-step walk-through, see our guide on what to do after a password breach.

Watch out for fake breach alerts

Scammers know that people panic after a breach notice. The FTC has warned about emails claiming your personal information is on sale, and some of them list real-looking details to make the message convincing. The safe habit is simple:

• Do not click links or open attachments in the alert.
• Open the provider’s site yourself, or use a bookmark you already trust.
• Never reply with passwords, codes or Social Security numbers.
• If an unsolicited message demands payment to “remove” your data, treat it as a scam.

Is it legal to scan or look at the dark web?

People often ask whether checking the dark web is illegal. Running a scan through a service is ordinary security hygiene: you are checking your own information against a database. Accessing the dark web is also not a crime in itself, since it is a network used for privacy. Europol’s reporting on its coordinated crackdowns makes the distinction: illegal activity there is still pursued. In May 2025, Operation RapTor led to 270 arrests of vendors and buyers across ten countries. Anonymity is not immunity.

The practical advice for a normal user is to avoid browsing the dark web yourself to hunt for your data. You can expose your device to malware and illegal content, and you gain nothing a scanning service would not tell you more safely.

How to choose a dark web scanning service

Whatever service you consider, judge it on these points:

• What it checks. Email only, or also phone numbers, domains and other identifiers?
• How often. One time, or continuous, with alerts?
• What the alert tells you. Which breach, which data type and what to do next.
• What happens after. Does it connect to password changes, MFA and a password manager, or only send a notification?
• Who it serves. Individuals and families need different things than a company with hundreds of logins.
• Price transparency. Published pricing beats “contact sales” for personal use.

Be skeptical of anything that promises to “remove your data from the dark web.” Nobody can credibly promise that.

Our perspective

We think of dark web scanning as the smoke detector in a larger security setup. We have seen many people treat a scan as the whole job: they run it, see a clean result and relax. We would rather you treat it as one signal among several.

Our view rests on three ideas. First, detection is only worth something if the response is fast, so an alert should point straight to action: reset, rotate, add MFA. Second, the best way to make a leak harmless is to make the leaked credential useless. That means unique passwords, which a password manager makes realistic, and sign-in methods that do not rely on a password alone, which is why we put so much into passwordless MFA. Third, exposure should be visible to the right people. Individuals want a simple alert. Businesses want to see their whole domain.

That is why our identity protection brings scanning, monitoring and credential hygiene together rather than selling each in isolation.

— Mike

Dark web monitoring with LogMeOnce

If you want more than a one-time check, we offer dark web monitoring as a subscription for individuals and families, alongside our password manager. Current published prices on our pricing and comparison page:

Businesses can see Teams, Business and Enterprise options. Teams is $4.00 per month per user and Business is $7.99 per month per user. Enterprise pricing is not published. To see how monitoring fits with the rest of our identity tools, visit our identity theft protection and dark web scan page or start with the dark web scan tool.

A simple routine that makes scans useful

Here is a routine you can set up in an afternoon:

1. Scan every email address you use for banking, shopping and work.
2. Move your passwords into a manager and replace anything reused or weak.
3. Turn on MFA for email, banking and any account that offers it.
4. Set up monitoring so that new exposure reaches you promptly.
5. Decide ahead of time what you will do when an alert arrives, so a notice does not become a panic.

Organizations should add: a named owner for alerts, a documented reset process and an MFA requirement for all staff. You can learn more about our wider approach on our cybersecurity page.

FAQ

How do I do a dark web scan?

Choose a reputable provider, enter the email address (or domain, if you are an organization) you want checked, and review the results. Start with the address you use for banking and account recovery. If anything appears, follow the steps above, beginning with your email password.

Is it illegal to enter the dark web?

No. The dark web is a network used for privacy, and accessing it is not a crime on its own. Illegal activity on it is prosecuted, as the 270 arrests in Operation RapTor in 2025 show. You do not need to visit it yourself to check your data, because a scanning service does that for you.

Does a clean scan mean my data is safe?

Not necessarily. A clean result means nothing was found in the sources that provider can see, at that moment. New breaches can expose you later, which is why continuous monitoring, unique passwords and MFA matter.

Can a dark web scan stop identity theft?

No. A scan detects exposure that has already happened. It helps because it gives you time to change passwords, enable MFA and, if sensitive identifiers leaked, place a fraud alert or credit freeze before anyone misuses the data.

Sources

• CISA: #StopRansomware Guide
• U.S. Department of Justice: America Under Cyber Siege
• Microsoft Tech Community: What’s in an MDTI Web Crawl?
• FTC: Did you get an email saying your personal info is for sale on the dark web?
• FTC: Use Two-Factor Authentication To Protect Your Accounts
• FTC: Have you been affected by a data breach?
• FTC: How to recover from identity theft
• Europol: 270 arrested in global dark web crackdown

Recommended

• Dark web email scan