Made in our lab
Cyber defender for small companies — leak watch and outside check of your domains
“Made in our own lab: every day our agents look for your company on ransomware leak sites without ever fetching stolen data, and check your domains from outside as anyone on the internet sees them. Once a month a plain-language report that Olaf reviews. We report findings; we never promise you are secure.”
CHF 149.00 a month, cancel any month.
Our own product
The first report arrives within 48 hours; cancel by email before it is sent for a full refund.
More from this aisle
This is the only product in this aisle.
What this helps you do
Know when your company turns up on a ransomware leak site, and what anyone on the internet can see of your domains, in plain words, every month.
What is included
For one company with 5 to 50 staff in Switzerland, Germany or Austria, on the domains you name. Every day, a leak watch: public ransomware trackers and onion search indexes are searched for your company and domains. We note only who, when, which group and what is claimed; we never open a leak site or download stolen data (find, don't fetch). A passive outside check of each domain: mail protection (SPF, DMARC, MTA-STS), certificates on websites and mail servers, website security headers, DNSSEC, the subdomains public certificate logs show, and outdated software your servers announce to every visitor. An alert by email within 24 hours when something new appears. Once a month, a report in plain language: what changed, what to fix first and how, and what could not be checked.
Requirements & compatibility
At checkout: your company's name, the domains to watch, who gets the alerts, and your confirmation that you own these domains and allow passive checks of them. Nothing to install, no access to your systems, no passwords. The first report comes by email within 48 hours of your order.
Before you buy
We report what we find; we never promise that you are secure, and a clean report does not mean nothing is wrong. Passive only: public records and one ordinary visit to each server, as any visitor makes. No attacks, no port scans, no logins, not a penetration test. We never download, open or buy stolen data. Not incident response, and we never negotiate with criminals: if you are attacked, call the police and report it to the Swiss Federal Office for Cybersecurity (BACS, formerly NCSC, https://www.bacs.admin.ch/). The lab's AI agents run the checks and write the reports and alerts; Olaf Kupschina reviews each one before it is sent. AI model providers process your domain names and the findings. No legal advice.
Delivery & refund
CHF 149 a month, charged by Stripe from the day you order. The first report comes by email within 48 hours; then one report a month, and an alert within 24 hours whenever something new appears. Cancel any month by email and no further month is charged. Until the first report is sent, cancelling gives a full refund. Never send passwords, keys or card details.
Sample report
Our own domain daice.net, checked with the same tool: first what it found on 4 November 2026, then the same check on 5 November, after we fixed it (by then it also read the software versions our servers announce).
Read the report
Before: 4 November 2026, 22:08 UTC
=================================
# daice.net: security check
**Needs attention: 2 urgent and 4 other things to fix.**
Checked 2026-11-04 22:08 UTC, passively: public records and one ordinary visit per server, no scans, no logins, no probing.
## Fix these, in this order
1. **SPF**: No SPF record: anyone can send mail that claims to be from you. *Fix:* Publish an SPF record listing the services that send your mail (or `v=spf1 -all` if the domain sends none).
2. **DMARC**: No DMARC policy: receivers are not told to reject forged mail. *Fix:* Publish `_dmarc` with `v=DMARC1; p=quarantine; rua=mailto:<a mailbox you read>`, then move to `p=reject`.
3. **Headers**: `strict-transport-security` is missing: nothing forces browsers onto HTTPS (HSTS). *Fix:* Add the `strict-transport-security` header on daice.net.
4. **DNSSEC**: DNSSEC is off: DNS answers for the domain can be forged. *Fix:* Turn on DNSSEC at the DNS host and add its DS record at the registrar.
5. **Headers**: `content-security-policy` is missing: nothing limits which scripts may run (CSP). *Fix:* Add the `content-security-policy` header on daice.net.
6. **Headers**: Nothing stops other sites framing yours (clickjacking). *Fix:* Add `X-Frame-Options: SAMEORIGIN` or CSP `frame-ancestors 'self'`.
## Already right
- **MX**: Receives no mail (no MX record), so mail protection is only about stopping others sending as you.
- **Web TLS**: daice.net: certificate valid and trusted, 69 days left.
- **Web TLS**: www.daice.net: certificate valid and trusted, 69 days left.
- **Headers**: `x-content-type-options` is set: it stops browsers guessing file types.
- **Headers**: `referrer-policy` is set: it keeps full addresses out of other sites' logs.
- **Leak watch**: Not listed as a ransomware victim on ransomware.live.
- **Leak watch**: Ahmia's onion index shows no page naming `daice.net`.
## Publicly visible names (certificate transparency)
11 names have had public certificates (Cert Spotter; crt.sh did not answer). Anything here you do not recognise or no longer use is worth switching off.
- *.academy.daice.net
- *.daice.net
- *.pitches.daice.net
- *.seo.daice.net
- *.shop.daice.net
- academy.daice.net
- daice.net
- pitches.daice.net
- seo.daice.net
- shop.daice.net
- www.daice.net
After the fixes: 5 November 2026, 00:47 UTC
===========================================
# daice.net: security check
**Sound, with 1 improvements to make.**
Checked 2026-11-05 00:47 UTC, passively: public records and one ordinary visit per server, no scans, no logins, no probing. Software versions are only what the website's headers and home page and the mail servers' greetings announce: no other page was asked for and nothing was tested for vulnerabilities.
## Fix these, in this order
1. **DNSSEC**: DNSSEC is off: DNS answers for the domain can be forged. *Fix:* Turn on DNSSEC at the DNS host and add its DS record at the registrar.
## Already right
- **MX**: Receives no mail (no MX record), so mail protection is only about stopping others sending as you.
- **SPF**: SPF is set: `v=spf1 -all`
- **DMARC**: DMARC policy is `reject`: `v=DMARC1; p=reject; sp=reject; rua=mailto:olaf@paradaice.info`
- **Web TLS**: daice.net: certificate valid and trusted, 69 days left.
- **Web TLS**: www.daice.net: certificate valid and trusted, 69 days left.
- **Headers**: `strict-transport-security` is set: it forces browsers onto HTTPS (HSTS).
- **Headers**: `content-security-policy` is set: it limits which scripts may run (CSP).
- **Headers**: `x-content-type-options` is set: it stops browsers guessing file types.
- **Headers**: `referrer-policy` is set: it keeps full addresses out of other sites' logs.
- **Headers**: Framing is restricted (clickjacking).
- **Software**: No software version is announced (good: nothing tells an attacker what to try) in daice.net's headers and home page.
- **Leak watch**: Not listed as a ransomware victim on ransomware.live.
- **Leak watch**: Ahmia's onion index shows no page naming `daice.net`.
## Publicly visible names (certificate transparency)
5 names have had public certificates (crt.sh). Anything here you do not recognise or no longer use is worth switching off.
- *.daice.net
- *.pitches.daice.net
- daice.net
- pitches.daice.net
- www.daice.net