harbourview-llp.example monitoring

Monitoring included with your assessment · 29 days left

Since 16 Oct 2026: 0 full daily reads of harbourview-llp.example; nothing closed yet.

Daily checks run through 15 Nov 2026. Nothing renews on its own; continuing is a separate subscription you choose.

I agree to the Terms of Service and Privacy Policy, including that the plan renews until I cancel. I am authorised to act for this business, and I authorise the daily external checks of harbourview-llp.example described in the Authorized Scan Agreement.

CAD · cancel any time

Discover

What we watch

Read from outside, the way an attacker would

What changed since last week

9 Oct to 16 Oct 2026

Nothing to compare yet

Since 16 Oct 2026: 0 full daily reads of harbourview-llp.example; nothing closed yet. Your baseline is the assessment of 15 Sep 2026. Each daily check is compared with the one before it, and anything that changes is listed here with its date.

harbourview-llp.exampleOpen: 1Closed: 0

Email: can it be forgedOpen

1 open, 2 settings to tidy
Look-alike domainsNothing open

Checked, nothing open
Firm addresses in breach listingsNothing open

Checked, nothing open
Website and serversNothing open

Checked, nothing open, 5 settings to tidy
Keys in your website codeNothing open

Checked, nothing open
What AI assistants say about youNot in this record

Not part of this record
Known exploited flawsNot yet checked

Compared with the actively exploited list once a day

Dated and sourced

Matched to you

Matched on the way in the source reported. It does not mean your firm was affected.

7 Oct 2026 · The Record

Arizona court system

As reported: The way in was email made to look like it came from a trusted sender.

On yours: Your domain does not yet reject forged email, which is the setting that stops this.

If it is used here: Mail forged in your name tells a client to pay somewhere new.

See the fix

Seen from outside

1 outside service in your DNS

This is the view an attacker's AI tools assemble first. We read it first.

Email authentication

DMARC not assessed (the lookup did not answer). SPF not assessed. DKIM couldn't be confirmed from outside (the key sits under a name only the mail service knows).

Services your DNS reveals

1 service in 1 category: email hosting. Microsoft 365 (email hosting)

Look-alike domains, live

6 registered and live

AI impersonation findings

Not checked on this reading

People your site names

Not counted on this reading

Would mail in your name be refused?

For each kind of service your DNS shows, what a receiving mail server does with mail that claims to come from you, read from your own SPF, DKIM and DMARC records.

Email hosting: Microsoft 365

Not assessed: the DMARC lookup did not answer on the day. Whether it signs your mail with DKIM cannot be seen from outside; confirm it in its settings.

include:spf.protection.outlook.com

Not assessed

How payment-change and invoice fraud use this view

Payment-change and invoice fraud does not need to break into anything. It relies on a client, or someone in your own office, trusting an email at the moment money is about to move, and acting on a request to pay into different bank details.

The view above is what makes that email believable. Your DNS tells anyone which services send mail for you, so they know which notices your clients expect to see. Whether that email is refused depends on your own records: without enforced DMARC, mail that only claims to be from your domain is still delivered.

It succeeds when three things line up: mail can pass as yours, nobody has a rule for checking a change of bank details, and a mailbox can be opened with a password alone. Each of the four controls below removes one of them.

Enforced email authentication. DMARC at p=quarantine, then p=reject, with every service that sends for you signing with a DKIM key published under your domain. Mail that fails is then refused, not delivered.
A written rule for bank-detail changes. Any change to bank or payment details is confirmed by phone on a number you already hold, never a number given in the message that asked for the change.
A notice to clients. "We never change bank details by email." On invoices, engagement letters and your email footer, so a client knows to call before paying anywhere new.
Multi-factor sign-in on every mailbox. So a password found in breach data, or guessed, does not open the mailbox a fraudulent request would be sent from or answered in.

Suppliers we watch

0 of 5

Name up to five suppliers or clients you pay or are paid by. Every hour we look for newly registered look-alike domains made from their names, the same way we look for ones made from yours, and email you the day we find one, those set up for email first. A domain like this is how a forged "our bank details have changed" email can arrive.

A look-alike of a supplier's domain is not a finding on your firm. It does not change your rating or your count of ways in.

Inside, confirmed by your team

Not on

Our reading is from outside. What only your own people can see, they check themselves: each person on your list gets a short email on your schedule with a few things to look at in their own email account, and records what they found here with the date. You get an email at once if anyone finds something or could not do a check.

These are your team's own confirmations, each with its date. We do not go inside your email or systems, so we have not checked them. They are not findings, and they do not change your count of ways in or your rating.

How often

The inside checklist is not on. Choose how often, add the people to include, and save.

We could not tell your mail system from outside, so each step is worded in general terms.

Who gets it

You[email protected]. Once a month the list sent to you also asks about accounts of former staff, the list of admins, and a backup test.

Validate

Open and closed, with the fix and the proof

1 way in open · 7 settings to tidy · 0 closed and confirmed · latest assessment 15 Sep 2026

Item

Status

Fix

Who

Nothing tells mail servers to refuse email forged in your name

Technical name: No DMARC record

Attackers can send fake invoices and emails from your domain and recipients have no authoritative way to reject them

High · since 15 Sep

Open

Proof: run this

dig TXT _dmarc.harbourview-llp.example +short @1.1.1.1

Log into the company that manages your domain's DNS (usually where the domain is registered), then DNS Settings, then Add Record, then Type: TXT, then Name: _dmarc, then Value: v=DMARC1; p=none; rua=mailto:[email protected] (replace yourdomain.ca with your actual domain, and ADDRESS-YOU-READ with a mailbox someone at your firm reads, because the reports arrive there).

All 7 steps

Log into the company that manages your domain's DNS (usually where the domain is registered), then DNS Settings, then Add Record, then Type: TXT, then Name: _dmarc, then Value: v=DMARC1; p=none; rua=mailto:[email protected] (replace yourdomain.ca with your actual domain, and ADDRESS-YOU-READ with a mailbox someone at your firm reads, because the reports arrive there).
Read the reports that arrive for about two weeks to see every service that sends mail as you, such as your booking system, accounting software and payment processor, and make sure each one is covered by SPF and DKIM.
Then change p=none to p=quarantine only when every one of those services is covered, and to p=reject the same way.
The date alone does not make a step safe: do not raise it until the reports show every sender is covered.
Do not go straight to p=reject: enforcing before every sender is known can stop your own mail being delivered.
At p=reject, receiving mail servers refuse email that pretends to come from your domain.
It stops forged mail from your own domain; lookalike domains need watching separately.

Where: Your DNS settings

Your site is missing 6 browser protections

Technical name: Missing security headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy

Missing: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

Strict-Transport-Security: Browsers are not told to always use a secure connection to your site
Content-Security-Policy: Your site does not limit which scripts may run on its pages
X-Frame-Options: Your site can be shown inside someone else's page
X-Content-Type-Options: A browser may treat a file from your site as something it is not
Referrer-Policy: Your site passes the addresses visitors came from to outside services
Permissions-Policy: Your site does not limit what outside scripts may ask a visitor's browser for

Setting to tidy · Medium · since 15 Sep

Open

Proof: run this

curl -sI https://harbourview-llp.example/

Add these response headers to every page of your site: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

All 3 steps

Add these response headers to every page of your site: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
Set them wherever your site's response headers are set: your web server settings, your host's control panel or your CDN.
Then run the check shown here and confirm each one appears.

Where: Your website

Your domain's address records are not signed

Technical name: DNSSEC not enabled

Your domain's traffic can be redirected to a fake version of your website without detection

Setting to tidy · Low · since 15 Sep

Open

Proof: run this

dig DNSKEY harbourview-llp.example @1.1.1.1 +dnssec

Enable DNSSEC at your DNS provider.

All 2 steps

Enable DNSSEC at your DNS provider.
Most providers now offer it as a single setting; it signs your records so they cannot be quietly altered in transit.

Where: Your DNS settings

A public file on your site lists the addresses of its private areas

Technical name: robots.txt lists internal paths

This tells attackers exactly where to look for admin panels and private areas

Setting to tidy · Low · since 15 Sep

Open

Proof: run this

curl -s https://harbourview-llp.example/robots.txt

Remove internal and administrative paths from robots.txt.

All 2 steps

Remove internal and administrative paths from robots.txt.
The file is public, so listing a path there advertises it rather than hiding it.

Where: Your website

Email on its way to you is not required to travel encrypted

Technical name: MTA-STS not enforced

Other mail servers are not required to use an encrypted connection when they send email to you.

Setting to tidy · Low · since 15 Sep

Open

Proof: run this

dig TXT _mta-sts.harbourview-llp.example +short @1.1.1.1 ; curl -s https://mta-sts.harbourview-llp.example/.well-known/mta-sts.txt

Publish an MTA-STS policy and a TLS-RPT record so mail to your domain cannot be silently downgraded to an unencrypted connection.

Where: Your DNS settings

You get no reports when email to you fails to arrive securely

Technical name: TLS-RPT not set up

You get no notice when another mail server cannot deliver email to you over an encrypted connection, so a delivery problem or an attempt to interfere would go unseen.

Setting to tidy · Low · since 15 Sep

Open

Proof: run this

dig TXT _smtp._tls.harbourview-llp.example +short @1.1.1.1

Add a TXT record named _smtp._tls for your domain with the value v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.

All 3 steps

Add a TXT record named _smtp._tls for your domain with the value v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.
Use an address someone reads.
Mail servers then send you a daily report whenever encrypted delivery to your domain fails.

Where: Your DNS settings

Your website lists the names of the accounts that can sign in to it

Technical name: WordPress user list exposed

Your website lists the usernames of the people who can sign in to it, which leaves only the password to guess.

Setting to tidy · Low · since 15 Sep

Open

Proof: run this

curl -s https://harbourview-llp.example/wp-json/wp/v2/users | jq

Disable the WordPress REST users endpoint, or restrict it to authenticated requests.

All 2 steps

Disable the WordPress REST users endpoint, or restrict it to authenticated requests.
Most security plugins expose this as one toggle.

Where: Your domain and website settings

An online storage folder with your firm's name exists, called harbourview-llp. We could not open it and cannot tell whose it is. Please say whether it is yours

Anyone can pick any storage name. Answer on your assessment page: if it is not yours, this closes; if it is, the steps to check are there.

Setting to tidy · Low · since 15 Sep

Please confirm

The step-by-step fix is in your assessment.

Where: Your domain and website settings

Last 90 days · daily readings · a lower rating is better

Rating, for comparison only

High: a way in is open: email forged in your name would not be refused. The band is decided by what was found; the number only orders firms inside a band. 10 of 10 checks answered. The rating describes what can be read from outside your firm. It says nothing about what is inside: devices, backups, staff sign-in settings or training. How the rating works, and how to tell us it is wrong.

One reading so far: 66 on 15 Sep

The line starts with the second daily check. Each check adds a reading here.

Against your sector

Your firm ranks 36 of 100 among 816 law firms we have read.

1 · least exposed100 · most exposed

1 is the least exposed and 100 the most. Each firm counts once, at its latest assessment; test, demonstration and incomplete assessments are left out. No other firm is named. Recomputed daily, last on 16 Oct 2026.

Finding	Share of law firms	Yours
Email that can be forged in the firm’s name	71% of 818	You have this
No list of allowed mail senders (SPF)	12% of 818	Clear
Firm addresses in breach databases	29% of 522	You have this
Look-alike domains registered	66% of 819	Not assessed
A service reachable that should not be	31% of 467	Not assessed

Watched for you since 16 Oct 2026

daily checks completed

new openings raised

incidents matched to you

Counts start with your first daily check.

Your dashboard lists what each AI agent did for your firm, newest first. Every line carries its date and the stage that did it, and a closed finding carries the evidence of the re-check. When a check finds a change, the Monitor AI agent puts first the one that needs you, with a plain reason when it has one. The change and its severity come from the fixed check. Your AI security agent is on your assessment page. Ask it about any finding, have it draft a note about one, or approve a re-check. Our AI agents work from outside only. They never log in, never install anything, and never touch your internal systems. The one change they can make, to your email records, happens only when you approve it. Open your assessment page. What your AI agents can and can't do

For your partners, broker or clients

Assessment Record

Dated record, issued by LeakTrace Inc.

A dated record of what was assessed on harbourview-llp.example and what was found, dated to your latest check. It is not a certification, not a penetration test, not legal or compliance advice, and not a statement about your internal systems. Outside verified by us. Inside confirmed by your team. The record holds the outside half. Your team's own checks are kept apart from it, each with its date, on your assessment page.

Download PDF

Alert preferences Monthly board summary Slack or Teams alerts Pause alerts Ask a question

Email settings, look-alikes and new host names: checked every hour, and emailed when found. A look-alike can be registered any day after your assessment, so each hourly check looks for new ones. Everything else: checked daily and emailed the day it is found, with newly exploited flaws matched to your software within a day. Weekly briefing by email, and a board summary on the 1st of each month.