Nightprill monitors your organisation's exposure across data leaks, the clandestine web and your public infrastructure.
And it qualifies every finding before showing it to you — instead of dumping a raw feed where the real signal drowns.
Searching a brand name rather than a domain brings back everything that resembles it: a namesake, a commercial product, a word in another language. That noise is the price of thoroughness — and it's exactly what the rest of the product resolves. Nothing is published automatically: an operator qualifies every finding before it appears in your portal.
A line found yesterday may have circulated for two years across hundreds of databases. The fingerprint is computed on the normalised line: the same data written differently is recognised as identical.
Eighteen-character CRM IDs, timestamps, role labels: many fields pass the "looks like a secret" test. And if several accounts in one leak share the same value, it's a column, not a password.
A discarded finding stays visible, with its reason. You see the sorting work, not just its result — which is what gives weight to the alerts that do come through.
A subdomain of a domain you own belongs to you, by definition — only its owner can create it. Names a cloud provider assigns to its customer aren't flagged as impersonation.
@yourbrand.com, we'll return the accounts we find."It only sees what carries one of your email addresses. Everything below is a blind spot:
The same three cases, now visible:
Not that data leaked — that a way into your organisation is on the market today. We match your perimeter against clandestine marketplaces and show you the listing: type of access, seller, host, country, date it went up.
Mailbox access to an organisation trades for twenty to thirty dollars. It is the single most actionable thing a monitoring service can surface — and most present it as one line in a list, if at all.
You declare your perimeter. We match it continuously against what circulates. What matters isn't how many sources we query — it's that an operator validates every finding before it reaches you.
On one client's perimeter, the brand keyword surfaced 1,630 findings — more than the 1,555 from their six domains combined. The order of magnitude changes when you search the name, not just the addresses.
A dedicated portal, hosted in Europe, protected by multi-factor authentication — no software to install. It updates continuously: you don't wait for a monthly report.
Headline metrics, a clickable timeline of releases, a table filterable by nature, state, period, sector, country. And on each finding, a plain badge whose tooltip explains what it means:
Secrets are masked but their length preserved: a four-character secret and a forty-character one aren't the same finding. And two dates are kept — a leak's release, and the moment you receive it. The median gap runs in days: that's the window you were exposed without knowing.
All of these run now. The perimeter is declared by you — domains, addresses, public IPs, keywords, partners. Nothing is guessed.
Occurrences of your brand, domains, addresses and public IPs across databases circulated on forums and Telegram channels.
Account, service, secret format, age — and the distinction between a real secret and a value that merely looks like one.
Hosts where a stealer captured corporate access, with the list of services reached and the network context.
Listings on clandestine marketplaces matched to your perimeter — access type, price, seller, host, country, date listed.
Typos, homoglyphs, alternative extensions, third-party subdomains. Enriched via RDAP and WHOIS, and checked for real existence before being shown.
Every certificate issued on a name close to your perimeter — often the first visible sign a look-alike has gone live.
An inventory of public hosts, DNS state, and addresses where several services coexist.
Victims tracked across group leak sites, matched daily to your perimeter and declared partners.
Every name in the perimeter carries its expiry date, recalculated on each view — yours and the look-alikes alike.
Beyond the core service, these extend your coverage when your perimeter calls for it — each set up with you, and only once it works on your own perimeter. We say plainly where each one stands.
These run today and are set up with you — including the GDPR basis when they concern individuals or payment data.
Monitoring triggered on a specific mailbox rather than a domain — eight sources queried per address. Reaches an executive's personal exposure that a domain search never does. Scoped under GDPR, since these are individuals.
Corporate card-prefix monitoring against clandestine marketplaces. Each listing carries the issuing bank, card type, country, seller and asking price. Scoped once you provide your prefixes, with the regulatory implications reviewed together first.
These are still in testing. We'll tell you plainly where each one stands when you ask — and we won't set one up until it works on your perimeter.
Scanning public repositories and contributors for exposed client material.
Exposed credentials compared against your declared policy; shared-secret lookup.
Brand search across social platforms.
A look-alike domain — once used to impersonate a client — about to lapse and become available again, to be caught before an attacker re-registers it. (We also flag your own names nearing expiry, in case internal tracking missed one.)
A host on the organisation's network, compromised for over a year, with the list of services whose access was captured.
Six alerts demanding a reset on a database with no passwords at all — only name, role and employer. Requalified as awareness.
Eighty public hosts mapped, including admin consoles and CI servers the team had forgotten.
A domain registered under privacy, used, then left to expire — about to become available to a third party.
An exposure found by the brand name, in a leak where none of the client's addresses appear. The case that alone justifies the mention-based approach.
Enterprise intelligence platforms quote only behind a sales call, then grow with metered add-ons you discover on the invoice. We publish our price, include the sorting, and add nothing later.
example.com brings in admin.example.com and everything after it. A brand is a name watched for itself, independent of your domains — it's what finds the exposure that names you without citing you. A declared partner is checked for co-occurrence only — we report that you appear in the same source, never their data. Same engine, same depth of sorting on every plan — only the size of the perimeter changes.
Beyond your plan, the perimeter grows by the unit: an extra domain is €1,200/year, a public IP €600, a declared partner €2,500, a brand €7,500 — and the arithmetic tips you into Scope at the right moment (around the eighteenth domain — or the third brand — Scope already wins). You move up by the calculation, never because a function was held hostage.
Your price is set by the perimeter you declare at signing, and it doesn't move with what we find. Add a domain and the price changes; find a hundred exposures inside it and it doesn't. You're never billed per alert, per finding or per collection — that would only pay us to inflate a count. When the sorting is the product, billing on volume would contradict the whole point.
A full pass on one perimeter, the written report, and a second pass at thirty days to show what moved — a dated snapshot, not a lighter subscription. Subscribe within 60 days of that second pass and it's deducted from your first year — a first step into continuous monitoring, not a cheaper alternative to it.
Enterprise platforms are bought for their breadth, then blamed for their noise: paying six figures a year and still not knowing what to act on first. That gap — between everything and what matters — is what you're paying us to close.
A password we find is fingerprinted — turned into an irreversible signature that lets us recognise it without holding it. The value itself is written nowhere.
Access is protected by multi-factor authentication and network-level restrictions. Credentials are stored as irreversible fingerprints — never in cleartext.
A dedicated instance per client — no data tenancy shared between organisations. Encrypted volume at rest, European hosting. Your data is not sold, shared or repurposed. Queries reach our data provider, listed in our subprocessor register.
Special categories — such as health, orientation or beliefs — are identified and discarded, including when it's the leak's name alone that reveals them. Mixed leaks are flagged as such.
And what Nightprill does not do, because that's what makes the rest credible: it doesn't replace a SOC, doesn't watch your internal network, doesn't detect an intrusion in progress. It doesn't claim exhaustiveness — coverage depends on accessible sources, and some national registries publish no registration data. And it never keeps the secrets it finds.
Give us a brand and a domain. We search — it's all open-source, so there's nothing to authorise — then walk you through what surfaces in a 30-minute live session, on screen, under NDA. You'll see what we'd flag and the noise we'd have discarded — not a report to keep. The full findings come with the engagement.
Request a demonstration