Signals — dark web, infostealer & leaked-credential intelligence
Continuous surveillance of darknet markets, paste sites and forums. Compromised-credential and infostealer-log alerts, 40B+ indexed records. Email, Slack and Telegram alerts on every plan; SIEM and SOAR export from Professional.
Signals is Passeca's threat-intelligence product for dark-web, infostealer and leaked-credential monitoring. It continuously surveils darknet markets, paste sites and forums, indexing 40 billion-plus records, and alerts on compromised credentials and infostealer logs before they can be used. Signals runs as a dedicated product at signals.passeca.com.
What is Signals?
The threat-intelligence product that finds your exposure before an attacker does.
Most attacks don't begin with a zero-day. They begin with a leaked credential, a stolen session cookie, or an infostealer log traded on a dark-web forum. Signals exists to find that exposure first — to tell you what the dark web already knows about your organisation before it is used against you.
The product runs at signals.passeca.com as a dedicated platform, with continuous monitoring, alerting, and a free domain exposure check. For Passeca managed-service customers, the same intelligence feeds into PassIRP as enriched detections.
What does Signals monitor?
Six source classes, all focused on the exposure that precedes an attack.
Dark-web markets & forums
Continuous surveillance of darknet marketplaces and criminal forums where stolen data, access brokers and attack tools are traded.
Infostealer logs
Machine-readable logs stolen by infostealer malware — cookies, session tokens, saved credentials — captured and flagged before they can be used.
Leaked credentials
Usernames and passwords exposed in data breaches and dumps, matched to your domains so you can force resets before account takeover.
Ransomware leak sites
Tracking of ransomware-group victim lists and leak sites, so you know the moment a supplier — or your own organisation — is named.
Brand abuse & impersonation
Look-alike domains, spoofed brands and fraudulent social profiles that target your customers and employees.
Paste sites & code repos
Public paste sites and code repositories where developers accidentally leak secrets, keys and internal information.
What does a Signals alert look like?
An example of the intelligence you receive the moment your exposure appears.
- Domain
- example.com
- Source
- Infostealer log (dark-web market)
- Exposed identity
- [email protected]
- Captured data
- Email + password hash, session cookie
- Recommended action
- Force password reset, revoke active sessions, enable MFA
Illustrative example. Real alerts include the specific source, timestamp and matched records.
Free domain exposure check
An immediate, personalised result for your domain.
Enter your domain and Signals returns an immediate report of what the dark web already knows about you — leaked credentials, infostealer logs and exposed services. The result is personalised, often alarming, and free. It is the fastest way to understand whether your organisation has live exposure worth acting on.
How much does Signals cost?
Four plans with published prices, from 1 to 10,000+ employees. 14-day free trial, no credit card.
Signals is priced by monitored identities: the email addresses on your domains, including former staff and shared mailboxes. Every plan includes:
- dark-web, infostealer, breach and session-cookie monitoring;
- unlimited findings and alerts;
- alerts by email, Slack and Telegram;
- an audit log.
The domain exposure check is free.
Starter
≈ 1–49 employees
€990/yr (€83/mo billed annually)
- 50 identities
- 1 root domain
- 2 seats
Essentials
≈ 50–250 employees
€3,690/yr (€308/mo billed annually)
- 300 identities
- 3 root domains
- 5 seats
Professional
Recommended for 251–1,000 employees≈ 251–1,000 employees
€11,490/yr, billed annually
- 1,500 identities
- 5 root domains
- 15 seats
Enterprise
≈ 1,000+ employees
from €32,900/yr
- 5,000+ identities
- 15 root domains
- 99.9% SLA, account manager
Prices in EUR, excl. VAT. Launch pricing, locked for 24 months for customers who sign before Signals NG launches.
For MSPs and MSSPs: multi-tenant console, white-label client reports and monthly billing.
Contact usFor Passeca managed-service customers (SOC-as-a-Service, MDR), Signals intelligence is included as a feed into PassIRP.
Signals, answered
The questions security and IT leaders ask about dark-web and credential monitoring.
What is Signals?
What does Signals monitor?
How many records does Signals index?
How do I get alerted when my credentials are leaked?
Can Signals integrate with my SIEM or Slack?
How is Signals priced?
Do you offer MSP/MSSP pricing?
Is the free domain exposure check really free?
How does Signals relate to Passeca's threat-intelligence service?
Where do I use Signals?
See what the dark web knows about you
Run the free domain exposure check. You receive an immediate, personalised report of leaked credentials, infostealer logs and exposed services — then decide whether continuous monitoring is worth it.
Related