Often there is no exploit at all. A staff password from an unrelated breach still works, or a look-alike domain harvests one from a customer. That is the part of the attack surface that sits outside the perimeter entirely, and no internal scanner can see it.
What this page checks
Credential exposure by domain — accounts on your domains that appear in breach corpora, which is the list of people who need a password reset today rather than at the next policy cycle.
Dark and deep web mentions — where the organisation is being discussed or traded, before it turns into an incident.
Look-alike domains — registrations designed to be mistaken for yours, which collect credentials from your customers without ever touching your infrastructure.
Impersonating applications — apps published under your brand that you did not publish.
How it runs
This page is an interactive demonstration of the check rather than a live assessment of your estate — it shows the shape of the finding and how it is presented. For a real, continuous answer across every asset you own, the same check runs inside Maphra.
Where this sits in Maphra
This is one of Maphra's five pillars. Credential exposure in breach corpora, dark-web mentions, look-alike domains and impersonating apps — the attack paths that never touch your network. It is also the third step of the attack chain the platform is built around: credentials without hacking. Breach corpora are monitored for your domains, and brand monitoring watches for look-alike domains and impersonating applications targeting your users. New exposure raises an alert rather than waiting to be noticed in a quarterly review.
Questions
Why does a breach at an unrelated company matter to us?
Because people reuse passwords. A credential leaked from a service nobody at your organisation officially uses is still, often enough, a working credential for something you do operate.
What can we actually do about a look-alike domain?
The first thing is knowing it exists while it is still being set up rather than after it has been used. Continuous brand surveillance is what turns that from an incident report into an early warning.
A one-off check tells you about one asset today. Maphra
runs this continuously across everything it discovers, and
a walkthrough uses your own domain rather than a sample.