What it entails

Threat Scan Checks ingest dark-web and breach-database feeds to flag whether an identity or credential has been exposed within the last 3 days, 30 days, or earlier. They bucket compromise events by recency (high, medium, low) to surface the most urgent risks. Historical compromise age tiers help prioritize remediation.

Why it works

Attackers leverage freshly compromised credentials for account takeover and credential-stuffing before victims reset passwords. Recent breaches represent high-velocity fraud windows that automated monitoring can intercept.

Checks

The following are the distinct IDs and types of checks that are included in the Threat Scan Check Package.

BREACHED_IDENTITY_COMPROMISED

Recency of identity compromise events.

Value	Name	Description
`NEW`	Identity compromised very recently	The identity was breached in the last three days.
`RECENT`	Identity compromised in last month	The identity was breached in the last 30 days.
`OLDER`	Identity compromised over a month ago	The identity was breached more than 30 days ago.
`NONE`	No information available	No compromise information available.

EMAIL_ON_DARKWEB

Recency of exposure of email on the dark web.

Value	Name	Description
`NEW`	Email newly seen on the dark web	Email was seen on the dark web in the last three days.
`RECENT`	Email recently seen on the dark web	Email was seen on the dark web less than 30 days ago.
`OLDER`	Email seen on the dark web	Email was seen on the dark web 30 or more days ago.
`NONE`	Email was not seen on the dark web	Email was not seen on the dark web.

PHONE_ON_DARKWEB

Recency of exposure of phone number on the dark web.

Value	Name	Description
`NEW`	Phone number newly seen on the dark web	Phone number was seen on the dark web in the last three days.
`RECENT`	Phone number recently seen on the dark web	Phone number was seen on the dark web less than 30 days ago.
`OLDER`	Phone number seen on the dark web	Phone number was seen on the dark web 30 or more days ago.
`NONE`	Phone number was not seen on the dark web	Phone number was not seen on the dark web.

SOCIAL_USERNAME_ON_DARKWEB

Recency of exposure of social media profile username on the dark web.

Value	Name	Description
`NEW`	Username newly seen on the dark web	Username was seen on the dark web in the last three days.
`RECENT`	Username recently seen on the dark web	Username was seen on the dark web less than 30 days ago.
`OLDER`	Username seen on the dark web	Username was seen on the dark web 30 or more days ago.
`NONE`	Username was not seen on the dark web	Username was not seen on the dark web.

NAME_ADDRESS_ON_DARKWEB

Recency of exposure of name and address on the dark web.

Value	Name	Description
`NEW`	Name and address newly seen on the dark web	Name and address were seen on the dark web in the last three days.
`RECENT`	Name and address recently seen on the dark web	Name and address were seen on the dark web less than 30 days ago.
`OLDER`	Name and address seen on the dark web	Name and address were seen on the dark web 30 or more days ago.
`NONE`	Name and address were not seen on the dark web	Name and address were not seen on the dark web.

SSN_ON_DARKWEB

Recency of exposure of SSN on the dark web.

Value	Name	Description
`NEW`	SSN newly seen on the dark web	SSN was seen on the dark web in the last three days.
`RECENT`	SSN recently seen on the dark web	SSN was seen on the dark web less than 30 days ago.
`OLDER`	SSN seen on the dark web	SSN was seen on the dark web 30 or more days ago.
`NONE`	SSN was not seen on the dark web	SSN was not seen on the dark web.

IDENTITY_MALWARE_INFECTED

Recency of exposure to malware.

Value	Name	Description
`NEW`	Malware infection newly seen on the dark web	Malware infection was seen on the dark web in the last three days.
`RECENT`	Malware infection recently seen on the dark web	Malware infection was seen on the dark web less than 30 days ago.
`OLDER`	Malware infection seen on the dark web	Malware infection was seen on the dark web 30 or more days ago.
`NONE`	Malware infection was not seen on the dark web	Malware infection was not seen on the dark web.

IDENTITY_PHISHED

Recency of successful phishing attempt.

Value	Name	Description
`NEW`	Successful phishing newly seen on the dark web	Successful phishing was seen on the dark web in the last three days.
`RECENT`	Successful phishing recently seen on the dark web	Successful phishing was seen on the dark web less than 30 days ago.
`OLDER`	Successful phishing seen on the dark web	Successful phishing was seen on the dark web 30 or more days ago.
`NONE`	Successful phishing was not seen on the dark web	Successful phishing was not seen on the dark web.