LeakTrace
Harbourview Law LLP
Jordan Wexley
Monitoring harbourview-llp.example · watched since 30 Oct 2026 Next check in 29:32:22
Attacker’s-eye view · Evidence-grade · Human-verifiedBaseline human-verified

Watched from outside from 30 Oct 2026. First check 1 Nov, 03:50 ET.

Your first daily check compares your domain with the assessment of 29 Sep 2026. From then on, anything that changes is listed here with its date.
The outside record of trust
1
way in open
7 settings to tidy, counted apart
Each with its proof
1
Open
0
Closed and confirmed
  1. Discover1 way in open0 new in 7 days
  2. ValidateEach with its proofRead from outside
  3. Close0 closed and confirmedBy our re-check
  4. MonitorEvery 5 minutes, hourly and daily0 daily checks so far
Every figure on this page comes from your own checks.

Every step here is your decision. We mark what we recommend first; Skip records that you considered it.

Next: Nothing tells mail servers to refuse email forged in your name · About 20 minutes

  1. Show me how
    Where it is doneYour DNS settings
    1. In the Microsoft Defender portal, go to Email & collaboration, then Policies & rules, then Threat policies, then Email authentication settings. Open the DKIM tab and check that signing is on for harbourview-llp.example. If it is not, publish the two CNAME records it shows at your DNS host and turn signing on.
    2. Your SPF record lists one service that sends mail for harbourview-llp.example (Microsoft 365), so start at p=quarantine. Publish this record at _dmarc.harbourview-llp.example: v=DMARC1; p=quarantine; rua=mailto:[email protected]
    3. The reports go to the LeakTrace report desk at [email protected]. You can put a mailbox of your own in its place.
    4. Sign in to the company that runs the DNS for harbourview-llp.example. It is the one whose name servers your domain uses, which is not always where you bought the domain.
    5. Open the DNS records for harbourview-llp.example. The screen is usually called DNS, DNS records or Zone editor.
    6. Add a new record and choose the type TXT.
    7. Type _dmarc as the name. If the screen does not add your domain itself, type _dmarc.harbourview-llp.example.
    8. Paste the record above as the value, exactly as copied.
    9. Save the record.
    10. Read the reports for about two weeks. When no mail your firm really sends is landing in spam, change p=quarantine to p=reject in the same record.
    11. The general steps for any DNS host are at getleaktrace.com/fix/.
    What changesNothing changes for delivery. Inboxes start sending daily reports on who sends mail as harbourview-llp.example.
    Can it stay onIt stays on for good. Nobody needs to touch it day to day.
    To undo itIf real mail is turned away, set the policy back one step in the same record at your DNS host and mail flows again while the missing service is added.
  2. Your site is missing 6 browser protectionsAbout 20 minutes
    Show me how
    Where it is doneYour website
    1. Add these response headers to every page of your site: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
    2. Set them wherever your site's response headers are set: your web server settings, your host's control panel or your CDN.
    3. Then run the check shown here and confirm each one appears.
    What changesVisitors see no difference. Browsers follow the new setting quietly.
    Can it stay onIt stays on.
    To undo itRemove the setting in the same place if a page stops working and tell us.
  3. Your domain's address records are not signedAbout 15 minutes
    Show me how
    Where it is doneYour DNS settings
    1. Enable DNSSEC at your DNS provider.
    2. Most providers now offer it as a single setting; it signs your records so they cannot be quietly altered in transit.
    What changesNothing changes for your clients or staff. The name stops pointing somewhere you no longer use.
    Can it stay onIt stays as it is once done.
    To undo itThe old record can be added back in the same DNS settings if something you still use stops answering.
See all (9 open)
  1. A public file on your site lists the addresses of its private areasAbout 20 minutes
    Show me how
    Where it is doneYour website
    1. Remove internal and administrative paths from robots.txt.
    2. The file is public, so listing a path there advertises it rather than hiding it.
    What changesVisitors see no difference. Browsers follow the new setting quietly.
    Can it stay onIt stays on.
    To undo itRemove the setting in the same place if a page stops working and tell us.
  2. Email on its way to you is not required to travel encryptedAbout 20 minutes
    Show me how
    Where it is doneYour DNS settings
    1. Publish an MTA-STS policy and a TLS-RPT record so mail to your domain cannot be silently downgraded to an unencrypted connection.
    What changesInboxes that receive mail in your firm's name follow the rule you publish. Mail your firm really sends keeps arriving; the reports show any service that still needs adding.
    Can it stay onIt stays on for good. Nobody needs to touch it day to day.
    To undo itIf real mail is turned away, set the policy back one step in the same record (p=quarantine or p=none) and mail flows again while the missing service is added.
  3. You get no reports when email to you fails to arrive securelyAbout 20 minutes
    Show me how
    Where it is doneYour DNS settings
    1. Add a TXT record named _smtp._tls for your domain with the value v=TLSRPTv1; rua=mailto:[email protected].
    2. Use an address someone reads.
    3. Mail servers then send you a daily report whenever encrypted delivery to your domain fails.
    What changesInboxes that receive mail in your firm's name follow the rule you publish. Mail your firm really sends keeps arriving; the reports show any service that still needs adding.
    Can it stay onIt stays on for good. Nobody needs to touch it day to day.
    To undo itIf real mail is turned away, set the policy back one step in the same record (p=quarantine or p=none) and mail flows again while the missing service is added.
  4. Your website lists the names of the accounts that can sign in to itAbout 20 minutes
    Show me how
    Where it is doneYour domain and website settings
    1. Disable the WordPress REST users endpoint, or restrict it to authenticated requests.
    2. Most security plugins expose this as one toggle.
    What changesNothing changes for your clients or staff day to day.
    Can it stay onIt can stay as it is once done.
    To undo itEach change is made in one place and can be reversed there.
  5. An online storage folder with your firm's name exists, called harbourview-llp. We could not open it and cannot tell whose it is. Please say whether it is yoursAbout 15 minutes
    Show me how
    Where it is doneYour domain and website settings
    1. Write to us and we send the exact steps.
    What changesFiles there are no longer open to anyone with the address. People you share with get a link of their own.
    Can it stay onIt stays private.
    To undo itSharing can be turned back on for one file in the same account.
  6. One step further2 minutes
    Nothing has been seen from this name yet. If you want to go one step further, this is the note to send.

    A note to our clients from Harbourview Law LLP.

    We never change our wiring instructions or bank details by email. If an email asks you to pay to a new account, or says our details have changed, do not reply to it and do not pay. Call us on the number you already have for us, not a number given in that email.

    Our own address is harbourview-llp.example. Thank you for checking with us first.

    Show me how
    Where it is doneYour own email
    1. Press Copy message.
    2. Paste it into an email to your clients, or into your next update to them.
    3. Send it from your usual address.
    What changesYour clients know to call before they pay to new details.
    Can it stay onYou can keep the last line in every email that carries payment details. A rule for you, not part of the message: If a suspicious sender asks who checks your email security, do not say.
    To undo itNothing to undo.
  7. Add the firms money moves betweenabout five minutes
    Examples for your line of work: title insurers, lenders and the other side's firm
    Show me how
    Where it is doneThe supplier block on this page
    1. Open the supplier block on this page.
    2. Add the web address of each firm money moves between you and them. Examples: title insurers, lenders and the other side's firm.
    3. Add up to 10. We look for new look-alikes of each name while monitoring is on.
    What changesWe email you the day a new domain made from one of their names appears and is worth a look.
    Can it stay onIt can stay on for good. You can remove a name or add another at any time.
    To undo itRemove the name from the same block.
    Go to the supplier block
Send to my insurer or broker

Your record, dated, with a fingerprint anyone can check. A one-page summary of the email-security questions renewal forms ask, answered from your record.

View the summaryDownload
Monitoring included with your assessment · 29 days left

Since 30 Oct 2026: 0 full daily reads of harbourview-llp.example; nothing closed yet.

Daily checks run through 29 Nov 2026. Nothing renews on its own; continuing is a separate subscription you choose.

CAD · cancel any time
Discover

What we watch

Read from outside, the way an attacker would

What changed since last week

23 Oct to 30 Oct 2026

Nothing to compare yet

Since 30 Oct 2026: 0 full daily reads of harbourview-llp.example; nothing closed yet. Your baseline is the assessment of 29 Sep 2026. Each daily check is compared with the one before it and anything that changes is listed here with its date.

harbourview-llp.exampleOpen: 1Closed: 0
  • Email: can it be forgedOpen
    1 open, 2 settings to tidy
  • Look-alike domainsNothing open
    Checked, nothing open
  • Firm addresses in breach listingsNothing open
    Checked, nothing open
  • Website and serversNothing open
    Checked, nothing open, 5 settings to tidy
  • Keys in your website codeNothing open
    Checked, nothing open
  • What AI assistants say about youNot in this record
    Not part of this record
  • Known exploited flawsNot yet checked
    Compared with the actively exploited list once a day
Dated and sourced

Matched to you

Matched on the way in the source reported. It does not mean your firm was affected.

7 Oct 2026 · The Record

Arizona court system

As reported: The way in was email made to look like it came from a trusted sender.
On yours: Your domain does not yet reject forged email, which is the setting that stops this.
If it is used here: Mail forged in your name tells a client to pay somewhere new.
See the fix

Seen from outside

1 outside service in your DNS

This is the view an attacker's AI tools assemble first. We read it first.

Email authentication
DMARC not assessed (the lookup did not answer). SPF not assessed. DKIM couldn't be confirmed from outside (the key sits under a name only the mail service knows).
Services your DNS reveals
1 service in 1 category: email hosting. Microsoft 365 (email hosting)
Look-alike domains, live
6 registered and live
AI impersonation findings
Not checked on this reading
People your site names
Not counted on this reading

Would mail in your name be refused?

For each kind of service your DNS shows, what a receiving mail server does with mail that claims to come from you, read from your own SPF, DKIM and DMARC records.

Email hosting: Microsoft 365
Not assessed: the DMARC lookup did not answer on the day. Whether it signs your mail with DKIM cannot be seen from outside; confirm it in its settings.
include:spf.protection.outlook.com
Not assessed

How payment-change and invoice fraud use this view

Payment-change and invoice fraud does not need to break into anything. It relies on a client, or someone in your own office, trusting an email at the moment money is about to move and acting on a request to pay into different bank details.

The view above is what makes that email believable. Your DNS tells anyone which services send mail for you, so they know which notices your clients expect to see. Whether that email is refused depends on your own records: without enforced DMARC, mail that only claims to be from your domain is still delivered.

It succeeds when three things line up: mail can pass as yours, nobody has a rule for checking a change of bank details and a mailbox can be opened with a password alone. Each of the four controls below removes one of them.

  1. Enforced email authentication. DMARC at p=quarantine, then p=reject, with every service that sends for you signing with a DKIM key published under your domain. Mail that fails is then refused, not delivered.
  2. A written rule for bank-detail changes. Any change to bank or payment details is confirmed by phone on a number you already hold, never a number given in the message that asked for the change.
  3. A notice to clients. "We never change bank details by email." On invoices, engagement letters and your email footer, so a client knows to call before paying anywhere new.
  4. Multi-factor sign-in on every mailbox. So a password found in breach data, or guessed, does not open the mailbox a fraudulent request would be sent from or answered in.

Checked and clear

We read the eleven things that reach law firms on 30 October: seven clear, two open and two to tidy.

  • Look-alike namesClear
    Names made from yours, each asked whether it is registered and set up for mail.
  • Files your site should not showClear
    Common addresses for configuration files, code folders and cloud storage.
  • Keys in your website's codeClear
    The scripts your front page loads, for keys and passwords left in them.
  • Software versionsClear
    The versions your website and its script libraries show.
  • Host names on your domainClear
    4 host names on your domain, from its own records and public certificate logs.
  • Your domain's registrationClear
    Its registry record: the expiry date and the lock that refuses a move to another registrar.
  • Spam, malware and phishing listsClear
    Whether your domain or its server is on a spam, malware or phishing list.

Listed with the findings, or not read

  • Forged email in your nameOpen
    The records that tell inboxes whether to refuse email sent as you (DMARC, SPF and DKIM).
    A way in that is open. Listed with the findings.
  • Firm addresses in breach dataOpen
    Breach records for addresses at your own domain.
    Fourteen addresses at your domain are listed. Listed with the findings.
  • Your website's certificateA setting to tidy
    The certificate your website answers with: its name, its dates and who issued it.
    A setting to tidy. Listed with the findings.
  • Your website's settingsA setting to tidy
    The headers and cookies your website sends to every visitor.
    A setting to tidy. Listed with the findings.

Since monitoring began

Since monitoring began on 30 October: no change recorded yet.

Suppliers we watch

0 of 10

Name up to ten suppliers or clients you pay or are paid by. Every hour we look for newly registered look-alike domains made from their names, the same way we look for ones made from yours and email you the day we find one, those set up for email first. A domain like this is how a forged "our bank details have changed" email can arrive.

A look-alike of a supplier's domain is not a finding on your firm. It does not change your rating or your count of ways in.

Suggested from your own mail records

Your reading of 30 October 2026 names no supplier we can suggest from your mail records. Name any supplier you pay in the form below.

Inside, confirmed by your team

Not on

Our reading is from outside. What only your own people can see, they check themselves: each person on your list gets a short email on your schedule with a few things to look at in their own email account and records what they found here with the date. You get an email at once if anyone finds something or could not do a check.

These are your team's own confirmations, each with its date. We do not go inside your email or systems, so we have not checked them. They are not findings and they do not change your count of ways in or your rating.

How often

The inside checklist is not on. Choose how often, add the people to include and save.

We could not tell your mail system from outside, so each step is worded in general terms.

Who gets it

You[email protected]. Once a month the list sent to you also asks about accounts of former staff, the list of admins, a backup test, what your email AI assistant may do with mail from outside, your office computers and your office network.

Check our office connection

Not added

Your assessment reads your domain and your website. The internet connection at your office is another address and only you can tell us which one it is.

Press the button while you are connected at the office. We show you the address first and nothing is added until you confirm.

Your data and research

We build de-identified data sets from how public security settings change and may license them to organisations that build and test AI security systems. Names, email addresses, domain names, your suppliers and clients, your notes and your documents are never in them. Our commitment on de-identified data.

Your firm is included in de-identified research and licensing.

Validate

Open and closed, with the fix and the proof

1 way in open · 7 settings to tidy · 0 closed and confirmed · latest assessment 29 Sep 2026

Item
Status
Fix
Where
Nothing tells mail servers to refuse email forged in your name
Technical name: No DMARC record
Attackers can send fake invoices and emails from your domain and recipients have no authoritative way to reject them
High · since 29 Sep
Open
Proof: run this
dig TXT _dmarc.harbourview-llp.example +short @1.1.1.1
In the Microsoft Defender portal, go to Email & collaboration, then Policies & rules, then Threat policies, then Email authentication settings. Open the DKIM tab and check that signing is on for harbourview-llp.example. If it is not, publish the two CNAME records it shows at your DNS host and turn signing on.
All 11 steps
  1. In the Microsoft Defender portal, go to Email & collaboration, then Policies & rules, then Threat policies, then Email authentication settings. Open the DKIM tab and check that signing is on for harbourview-llp.example. If it is not, publish the two CNAME records it shows at your DNS host and turn signing on.
  2. Your SPF record lists one service that sends mail for harbourview-llp.example (Microsoft 365), so start at p=quarantine. Publish this record at _dmarc.harbourview-llp.example: v=DMARC1; p=quarantine; rua=mailto:[email protected]
  3. The reports go to the LeakTrace report desk at [email protected]. You can put a mailbox of your own in its place.
  4. Sign in to the company that runs the DNS for harbourview-llp.example. It is the one whose name servers your domain uses, which is not always where you bought the domain.
  5. Open the DNS records for harbourview-llp.example. The screen is usually called DNS, DNS records or Zone editor.
  6. Add a new record and choose the type TXT.
  7. Type _dmarc as the name. If the screen does not add your domain itself, type _dmarc.harbourview-llp.example.
  8. Paste the record above as the value, exactly as copied.
  9. Save the record.
  10. Read the reports for about two weeks. When no mail your firm really sends is landing in spam, change p=quarantine to p=reject in the same record.
  11. The general steps for any DNS host are at getleaktrace.com/fix/.
Where: Your DNS settings
Your site is missing 6 browser protections
Technical name: Missing security headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
Missing: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
  • Strict-Transport-Security: Browsers are not told to always use a secure connection to your site
  • Content-Security-Policy: Your site does not limit which scripts may run on its pages
  • X-Frame-Options: Your site can be shown inside someone else's page
  • X-Content-Type-Options: A browser may treat a file from your site as something it is not
  • Referrer-Policy: Your site passes the addresses visitors came from to outside services
  • Permissions-Policy: Your site does not limit what outside scripts may ask a visitor's browser for
Setting to tidy · Medium · since 29 Sep
Open
Proof: run this
curl -sI https://harbourview-llp.example/
Add these response headers to every page of your site: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
All 3 steps
  1. Add these response headers to every page of your site: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
  2. Set them wherever your site's response headers are set: your web server settings, your host's control panel or your CDN.
  3. Then run the check shown here and confirm each one appears.
Where: Your website
Your domain's address records are not signed
Technical name: DNSSEC not enabled
Your domain's traffic can be redirected to a fake version of your website without detection
Setting to tidy · Low · since 29 Sep
Open
Proof: run this
dig DNSKEY harbourview-llp.example @1.1.1.1 +dnssec
Enable DNSSEC at your DNS provider.
All 2 steps
  1. Enable DNSSEC at your DNS provider.
  2. Most providers now offer it as a single setting; it signs your records so they cannot be quietly altered in transit.
Where: Your DNS settings
A public file on your site lists the addresses of its private areas
Technical name: robots.txt lists internal paths
This tells attackers exactly where to look for admin panels and private areas
Setting to tidy · Low · since 29 Sep
Open
Proof: run this
curl -s https://harbourview-llp.example/robots.txt
Remove internal and administrative paths from robots.txt.
All 2 steps
  1. Remove internal and administrative paths from robots.txt.
  2. The file is public, so listing a path there advertises it rather than hiding it.
Where: Your website
Email on its way to you is not required to travel encrypted
Technical name: MTA-STS not enforced
Other mail servers are not required to use an encrypted connection when they send email to you.
Setting to tidy · Low · since 29 Sep
Open
Proof: run this
dig TXT _mta-sts.harbourview-llp.example +short @1.1.1.1 ; curl -s https://mta-sts.harbourview-llp.example/.well-known/mta-sts.txt
Publish an MTA-STS policy and a TLS-RPT record so mail to your domain cannot be silently downgraded to an unencrypted connection.
Where: Your DNS settings
You get no reports when email to you fails to arrive securely
Technical name: TLS-RPT not set up
You get no notice when another mail server cannot deliver email to you over an encrypted connection, so a delivery problem or an attempt to interfere would go unseen.
Setting to tidy · Low · since 29 Sep
Open
Proof: run this
dig TXT _smtp._tls.harbourview-llp.example +short @1.1.1.1
Add a TXT record named _smtp._tls for your domain with the value v=TLSRPTv1; rua=mailto:[email protected].
All 3 steps
  1. Add a TXT record named _smtp._tls for your domain with the value v=TLSRPTv1; rua=mailto:[email protected].
  2. Use an address someone reads.
  3. Mail servers then send you a daily report whenever encrypted delivery to your domain fails.
Where: Your DNS settings
Your website lists the names of the accounts that can sign in to it
Technical name: WordPress user list exposed
Your website lists the usernames of the people who can sign in to it, which leaves only the password to guess.
Setting to tidy · Low · since 29 Sep
Open
Proof: run this
curl -s https://harbourview-llp.example/wp-json/wp/v2/users | jq
Disable the WordPress REST users endpoint, or restrict it to authenticated requests.
All 2 steps
  1. Disable the WordPress REST users endpoint, or restrict it to authenticated requests.
  2. Most security plugins expose this as one toggle.
Where: Your domain and website settings
An online storage folder with your firm's name exists, called harbourview-llp. We could not open it and cannot tell whose it is. Please say whether it is yours
Anyone can pick any storage name. Answer on your assessment page: if it is not yours, this closes; if it is, the steps to check are there.
Setting to tidy · Low · since 29 Sep
Please confirm
The step-by-step fix is in your assessment.
Where: Your domain and website settings
Last 90 days · daily readings · a lower rating is better

Rating, for comparison only

High: a way in is open: email forged in your name would not be refused. The band is decided by what was found; the number only orders firms inside a band. All thirteen checks answered: forged email in your name, look-alike names, firm addresses in breach data, your website's certificate, your website's settings, files your site should not show, keys in your website's code, software versions, services that answer from the internet, host names on your domain, your domain's registration, spam, malware and phishing lists and code, paste and document searches. Each one with its result. The rating describes what can be read from outside your firm. It says nothing about what is inside: devices, backups, staff sign-in settings or training. How the rating works and how to tell us it is wrong.

One reading so far: 66 on 29 Sep

The line starts with the second daily check. Each check adds a reading here.

Against your sector

Your firm ranks 36 of 100 among 935 law firms we have read.

1 · least exposed100 · most exposed

1 is the least exposed and 100 the most. Each firm counts once, at its latest assessment; test, demonstration and incomplete assessments are left out. No other firm is named. Recomputed daily, last on 30 Oct 2026.

FindingShare of law firmsYours
Email that can be forged in the firm’s name70% of 937You have this
No list of allowed mail senders (SPF)11% of 937Clear
Firm addresses in breach databases22% of 899You have this
Look-alike domains registered67% of 938Not assessed
A service reachable that should not be51% of 92Not assessed
Watched for you since 30 Oct 2026
0
daily checks completed
0
new openings raised

Counts start with your first daily check.

Your dashboard lists what each AI agent did for your firm, newest first. Every line carries its date and the stage that did it and a closed finding carries the evidence of the re-check. When a check finds a change, the Monitor AI agent puts first the one that needs you, with a plain reason when it has one. The change and its severity come from the fixed check. Your AI security agent is on your assessment page. Ask it about any finding, have it draft a note about one, or approve a re-check. Our AI agents operate externally. They never log in, never install anything and never touch your internal systems. The one change they can make, to your email records, happens only when you approve it. Open your assessment page. What your AI agents can and can't do

For your partners, broker or clients

Assessment Record

Dated record, issued by LeakTrace Inc.

A dated record of what was assessed on harbourview-llp.example and what was found, dated to your latest check. It is not a certification, not a penetration test, not legal or compliance advice and not a statement about your internal systems. Outside verified by us. Inside confirmed by your team. The record holds the outside half. Your team's own checks are kept apart from it, each with its date, on your assessment page.

Download PDF
Alert preferences Monthly board summary Slack or Teams alerts Pause alerts Ask a question
Read again today at 22:58.
Email settings: checked every 5 minutes and emailed when a change is found. New certificates for your domain and for look-alikes of your name: seen within minutes of being logged and emailed when found. A look-alike can be registered any day after your assessment, so each hourly check also looks for new ones. Everything else: checked daily and emailed the day it is found, with newly exploited flaws matched to your software within a day. Weekly briefing by email and a board summary on the 1st of each month.