LeakTrace Outside reading · Confidential
Harbourview Law LLP
Anyone can send email in the name of your business, and nothing your domain publishes tells mail servers to refuse it.
Rating band: High
This is what anyone can see about harbourview-law.example from outside, in monitored breach databases and in public records. We hold no keys to your firm. You can check the lead finding below yourself. The External Cybersecurity Assessment is the full list, with the proof for each finding.
Nothing was logged into or tested. To have this reading and your details deleted, reply to the email it came with or write to [email protected]. Outside Reading Policy
Nothing had to break for this to be open. It is open today, from outside, and looking at it from outside is nobody’s job until somebody does it.
The outside watch for Harbourview Law LLP
Discover. We read everything about your firm that anyone outside can see: email that can be forged in your name, look-alike domains, shared addresses in monitored breach databases, the software your site runs, and code and keys left in public.
Validate. The first finding listed below carries a command you can run yourself. If it shows something else, we are wrong. The record for each of the others is in the assessment.
Close. The assessment gives you the fix for each finding, step by step, and we re-check from outside until it is closed.
Monitor. When something new shows up, you hear it from us first, not from a client or a fraudster.
Attackers now use AI to read a firm from outside the way a search engine does: the website, directories, search results and what AI assistants say. We read it first, and every finding is human-verified before your assessment is released.
Is this reaching the right person?
This reading was prepared for whoever runs Harbourview Law LLP. If that is not you, tell us who it should go to and we will send it there instead.
Proof you can check yourself
We never accessed your systems. Everything below is public. Under the first finding listed is the command to check it. Run it. If it shows something else, we are wrong.
How easily email can be forged in your name
45
of 100, email only. A lower rating is better.
Your email records
Mail servers decide whether to trust email claiming to be from harbourview-law.example by reading records the domain publishes. Those records are public, and we read the same ones.
What your records say today
Someone can send an invoice or a payment instruction in the name of your business today, and nothing your domain publishes tells a mail server to refuse it.
No instruction is published for mail that fails its checks (no DMARC record).
What was publicly visible from outside on 15 October 2026. It does not cover your internal systems.
Your website, domain records and servers
high severity
3 findings across your website, domain records and servers.
HIGH Nothing tells mail servers to refuse email forged in your name Verify
Technical name: No DMARC record
What this means
Someone can send an invoice or a payment instruction in the name of your business today, and nothing your domain publishes tells a mail server to refuse it.
Why it matters for your business
Requests to pay or to move client money, and forged invoices, can be sent in your firm's name while this is open.
If this is used against you
- Direct loss
- Mail forged in your name tells a client to pay somewhere new. Reported business email compromise losses averaged roughly $123,000 per complaint in 2025. FBI IC3 2025
- Time lost
- Calling clients to confirm which messages were really yours.
- Response
- Speed matters: in 2025 the FBI froze 58% of the money it tried to stop after a fraud was reported. FBI IC3 2025
Evidence. Verify this yourself
This is your domain's public anti-forgery rule (DMARC). The response shows whether a rule exists telling other mail servers to reject email that fakes your domain. Anyone on the internet sees this exact same response.
Show the proof
What we found
;; status: NXDOMAIN (answered by 1.1.1.1): _dmarc.harbourview-law.example does not exist
Anyone technical can confirm this:
dig TXT _dmarc.harbourview-law.example +short @1.1.1.1
RFC 7489 · read on 15 October 2026
The check takes a minute, and anyone can run it. A gap like this is usually a default nobody was asked to change.
HIGH 1 domain made from your firm's name was registered on 5 September 2026, is set up to send and receive email and has no website. We cannot tell from outside who owns it. Is it yours?
Technical name: Look-alike domain with mail records
What this means
A domain very close to yours is set up to receive email and has no website. If its owner also sends from it, that mail can pass its own sender checks, so the settings on your own domain do not apply to it, and there is no website for anyone to look at.
Why it matters for your business
If it is not yours, it can send payment instructions that look like your firm's. The reply goes to them, and there is no website to check.
If this is used against you
- Direct loss
- Mail from a near-copy of your domain tells a client to pay somewhere new. Reported business email compromise losses averaged roughly $123,000 per complaint in 2025. FBI IC3 2025
- Time lost
- Calling clients to confirm which messages were really yours.
- Response
- Speed matters: in 2025 the FBI froze 58% of the money it tried to stop after a fraud was reported. FBI IC3 2025
The record
Read on 15 October 2026. The record for this finding is in the assessment.
If it is not yours
If you tell us it is not yours, your assessment includes a takedown request to its registrar: the registrar's abuse contact where the public record gives one, the evidence, and a letter in your firm's name, drafted for you or your lawyer to send. We do not send it, and the registrar decides what to do.
1 more finding below those shown above, which are ranked most severe first. The assessment lists it, with its fix.
The rest of the findings, and the fix for each, are in the assessment.
The next step
Order the External Cybersecurity Assessment. Every opening, its evidence and the fix, within 72 hours.
One payment. Delivered inside 72 hours of confirmation.
$700USD
Order the assessment
When we refund. Your assessment will show more than your outside reading. If it does not, we refund it in full.
Addresses on your domain are in breach records
high severity
Three addresses on your domain appear in monitored breach databases. The lookup does not say what was listed with them. If a password was reused anywhere else, that account is exposed.
If this is used against you
- Direct loss
- If a password was reused on a listed address, someone can open that mailbox and redirect a payment. Reported business email compromise losses averaged roughly $123,000 per complaint in 2025. FBI IC3 2025
- Time lost
- Changing the password on the 3 listed addresses, and anywhere else it was used: roughly 2 to 3 hours. Our estimate, 30 to 60 minutes each.
- Response
- Speed matters: in 2025 the FBI froze 58% of the money it tried to stop after a fraud was reported. FBI IC3 2025
The addresses we can name, the breaches they are listed in, and what to change are in the assessment.
More web addresses under your domain
low severity
3 web addresses sit under your domain.
The full list of web addresses under your domain is in the assessment.
Rules and cover
ABA Formal Opinion 477R expects lawyers to make reasonable efforts to prevent unauthorized access to client information sent over the internet. What is reasonable is judged case by case, starting with how sensitive the information is. ABA Formal Opinion 477R
ABA Formal Opinion 512 expects lawyers to understand the benefits and risks of the AI tools they use. Attackers use the same kind of tools against firms, and this reading shows what they find. ABA Formal Opinion 512
Why this matters now
On the public record
27 May 2025 · California Court of Appeal, Fourth District, case D083655 (United States): A California appeal court decision published in May 2025 covers a $475,000 settlement payment that went to criminals. They wrote to the paying side's lawyer from a domain one letter different from the other law firm's. The court ordered the paying side to pay again.
On harbourview-law.example: A domain made from your firm's name is registered and set up to send email.
7 Oct 2026 · The Record: Arizona court system. The way in was email made to look like it came from a trusted sender.
On harbourview-law.example: Nothing tells mail servers to refuse email forged in your name.
You already work to this standard.
You would not sign off on your own work. Nobody serious does, because the person who did the work cannot be the one who checks it. That rule stops at your own systems, where the person who set them up is the same person you would ask whether they were set up correctly.
External Cybersecurity Assessment
This is the view an attacker starts from.
The assessment gives you every address in breach records, every gap in your website, email and servers, and the order to close them in. We re-check from outside once you do. Written for Harbourview Law LLP, inside 72 hours.
What the assessment delivers
The full outside watch on your firm, the proof for every finding, and the fix, human-verified within 72 hours. Click any one for the detail
1 · Technical Evidence and FindingsThe evidence and the exact fixEvery weakness on anything you have online, and which of your addresses are in breach records
What you get
We read your website, email settings and sign-in pages from outside, for the openings attackers actually use to get in. You receive a list of every issue we find on harbourview-law.example and the exact step to fix each one. Most fixes take 5–30 minutes.
Who uses it
Your firm. Each issue has its steps in order; tick it off as fixed and we re-check it from outside.
2 · Owner Summary and Action BriefFor the ownerEverything that matters, in plain language
What you get
An Owner Summary and Action Brief you can read in 5 minutes: what’s at risk for Harbourview Law LLP, the three things to fix this week, and why each one matters. No technical jargon.
Who uses it
You, your business partner, your accountant. Written so a non-technical reader gets the full picture in five minutes.
3 · Rules and Insurance BriefingPrivacy rules and insurer questionsHow this affects your insurance renewal and the rules you fall under
What you get
Sets your findings beside the privacy and breach-notice rules for Canada or the United States, and beside the sector rule where one is named: law, health, accounting, and financial and wealth firms. Most technical findings fall under one safeguards rule. Then the questions insurers ask at renewal that an outside read can answer. It is not legal advice.
Who uses it
Your insurance broker at renewal. Your lawyer or accountant if there’s ever a review. Gaps you close now can save you from a denied claim or a fine later.
4 · Assessment RecordDated record, issued by LeakTrace Inc.What was read from outside and what was found, dated
What you get
A short record of the assessment of harbourview-law.example: the date, what was checked and what was found. It is the one document written for someone outside the firm. A dated record of what was read from outside your firm, verified by a person at LeakTrace before release. LeakTrace Inc. issues it as a company, with a reference and a fingerprint anyone can check at getleaktrace.com/verify/. No individual signs it. It is not a certification, not a penetration test, not legal or compliance advice, and not a statement about your internal systems.
Who uses it
Whoever you answer to: a client’s security questionnaire, your insurer at renewal, your own annual review file.
Beyond the evidence pack
5 · Monitoring, First Month Included. Hourly for email settings, look-alikes and new host names; daily for the rest; same-day alerts
What we watch
An address at harbourview-law.example appearing in a new breach, a look-alike domain registered against your name, a change to the records that tell mail servers what to do with mail forged in your name, a certificate about to lapse, a service that was closed opening again, and a flaw in software your website shows being added to the government's list of flaws under active attack, matched within a day.
Where we look
Breach databases, domain registration records, your published email and certificate records, and your public-facing servers. All of it from outside: nothing installed, no access to your systems or your inbox.
How you hear
You hear from us the day something changes, with what changed and what to do about it, and once a week a short note of what changed, or one line when nothing did.
After the first month
Nothing renews on its own. Continuing the watch is a separate subscription you choose, or you keep the assessment and stop there.
6 · A Fix for Every Finding. In your dashboard, in the order to do them, with the exact change written out
What you get
Every finding carries four things: what we saw, the one-line command that reproduces it, how it was checked, and the exact change to make. Ranked so the one that costs money is first and the cosmetic one is last. Most take between five and thirty minutes. Forged email closes where we can reach your DNS host. You approve each step with one click: reporting first, then refusing forged email, about four weeks in all, re-checked from outside at every step. Where we cannot, you get the exact record to paste.
Who uses it
Your firm. Each one is ticked off as it closes and re-checked from outside, so you can see what is done at a glance. We are paid by no one who sells the fixes, so every finding is independent.
7 · Delivered Inside 72 Hours. Inside 72 hours of confirmation, human-verified first
What happens
The full assessment runs against everything reachable without a login, every finding is human-verified before it reaches you, and the evidence for each is written and checked. Nothing is scheduled around your calendar and nothing needs a call with us first.
If we are late
You are told before the deadline rather than after it, with the reason.
The reading and the assessment
You already have the evidence. The assessment gives you the order to act on it.
What this reading gave you
Your rating and the areas behind it
The firm addresses we found in breach databases, and the infrastructure issues
How exposed your email is to impersonation
How many findings sit beyond this reading
Yours to keep, with the command behind the first finding printed next to it.
What the assessment adds
Every finding ranked, so you know what to fix first
The exact fix for each one, step by step
Every finding, not only the ones shown here
Set your findings beside the privacy and sector rules that apply, and the insurer questions an outside read can answer
Your evidence pack: an owner summary, the technical evidence, a rules and insurance briefing, and a dated assessment record
The watch keeps running from outside for your first month, and you hear it from us first, with nothing renewing on its own
The assessment comes with an AI security agent on your dashboard: ask it about any finding in plain English and it answers from your own firm's findings.
A dated, independent record of what was checked, when, and by whom. Give it to your lawyer or your insurer, or keep it on file.
Our AI agents work from outside only. They never log in, never install anything, and never touch your internal systems. The one change they can make, to your email records, happens only when you approve it.
What happens after you buy
Discover
Every finding fixed checks recorded on your firm from outside, each with its evidence. Once you buy, the Discover AI agent chooses follow-up checks.Validate
A person reads your assessment before it is released to you. Human-verified, inside 72 hours of confirmation.Close
After you buy, the Close AI agent gives you the steps for each finding, with your DNS host's own screens for an email record where we hold its guide. When you mark one done, AI chooses when to re-check from outside.Monitor
For the first month fixed checks re-check your email settings, look-alike domains and new host names every hour, and everything else every day. The Monitor AI agent puts first the change that needs you.You approve any change to your email records, one step at a time.
When we refund
Your assessment will show more than your outside reading. If it does not, we refund it in full.
The reading stays live for thirty days, then the link closes. Reply at any time and we will delete your details and this reading.
Book a 10-minute call →
Secure Checkout
Stripe-secured checkout
Prefer email? Reply to the email this reading came with, or write to [email protected].
Yours to keep, whatever you decide
Ten things to do this weekOpen the list ↓
Everything above is about Harbourview Law LLP, the domain and the email addresses attached to it. We did not look at anybody's personal accounts, and we would not. But a firm usually gets hurt through one owner's personal email. So this is the short list we would give a friend. There is nothing to sign up for and most of it takes an evening.
One thing that genuinely has changed: the scam email that used to give itself away with clumsy spelling does not any more. Assume the writing will be perfect and judge the request instead.
- Use an authenticator app rather than text-message codes on your email, your bank and anything holding money. A phone number can be taken from you. An app on the handset cannot.
- Treat your personal email as the master key, because it is. Whoever controls it can reset almost everything else you own. It deserves your strongest password and that password should exist nowhere else.
- Put a port-out PIN on your mobile account. One call to your carrier. It stops somebody talking your number onto their own phone, which is how text-message codes get defeated.
- Get a password manager. The value is not that the passwords are stronger. It is that a breach at one website stops at that website instead of walking into your bank.
- Any request to move money or change bank details gets a phone call on a number you already had, not one from the message. This single habit defeats the most expensive attack aimed at businesses your size.
- Keep the money separate from the everyday. The address on your website and your invoices should not be the address that recovers your bank login.
- Let the phone and the browser update themselves. Most break-ins use a hole that was fixed months earlier on machines that never restarted.
- Keep one backup the computer cannot reach on its own. That means an external drive you unplug, or a service with its own separate login. Ransomware encrypts everything it can see, including the backup drive left plugged in.
- Write down who you would call, today, while nothing is wrong. Your bank's fraud line, your web host, and your insurer. Working that out during an incident is what turns a bad afternoon into a bad month.
Three questions worth asking inside your firm▾
Before you decide
Three questions worth asking inside your firm.
Everything in this reading was observed from outside your business, the same way anyone else would see it. The first finding listed carries its own check, which anyone can run in a few minutes, and should. These three questions are the ones that decide whether anything on this page is news.
-
When did we last look at this from the outside, without using our own logins?Nearly all monitoring watches the inside of a network. What is on this page is what is reachable without any credentials at all, which is the view an attacker starts from and the one least likely to be covered.
-
Which of these did we already know about, and what was the decision not to change it?Some of it will be deliberate, and a good answer here is a real answer. What matters is whether it was a decision on record or something nobody had looked at.
-
What happens to a forged invoice sent in our name today, and when did we last test that?This is the one that costs money rather than reputation, and the answer is a date and a result, not an opinion. If there is no date, it has not been tested.
Why you can take these findings at face value.
We are paid the same amount whatever this assessment returns, and we do not sell the repair or take a referral from anyone who does. Nothing on this page is shaped by work we would like to be hired for. The assessment carries the evidence and the reproduction steps for every finding, so every line can be checked against your own systems.
Quick answers
Common questions, answered.
We already have someone who looks after our computers
The assessment is for them as much as for you. It is the outside view that cannot be seen from inside your systems: what anyone on the internet can already read about your firm, with the exact steps to fix each finding. It gives them a checked list to work from.
Can I just fix this myself?
Some of it, mostly the email records. Two things to know. A mistake in the record that guards against forged email can stop your own mail being delivered, so the order of the changes matters. And each change still has to be made. The assessment gives the exact steps in order, and we re-check each one from outside until it is closed.
How long does the assessment take?
Inside 72 hours of confirmation, and usually the same day. You’ll get an email with your private dashboard URL the moment the findings are ready, and your first month of full monitoring begins automatically (nothing renews unless you choose to continue).
What's in the assessment?
The full outside watch on your firm: every finding severity-ranked with the proof and the exact fix, human-verified before it is released; the evidence pack listed above; a first month of the watch for addresses in new breach records, look-alike domains and changes to your public records, all from outside; and a tamper-proof evidence stamp on every finding so the underlying evidence can be independently verified.
Can I cancel or get a refund?
In one case. Your assessment will show more than your outside reading. If it does not, we refund it in full. Ask within 14 days of delivery: email [email protected] with your reference. Once it has shown you more than the reading did, the work is done and it is not refundable. Read the full refund terms.
What did you look at, and how do I have this removed?
We read only what is visible from outside your firm: public records about harbourview-law.example and published breach lists. Nothing was logged into or tested. To have this reading and your details deleted, reply to the email it came with or write to [email protected]. What we read and what we never do is written down in our Outside Reading Policy.
READING ID 00000000 · Confidential · Demonstration reading · sample findings
To remove Harbourview Law LLP’s domain from future readings, reply to any LeakTrace email with “unsubscribe” or contact [email protected]. LeakTrace Inc., Toronto, Ontario, Canada.