Domain watch
Where website changes watch the website itself, the domain watch looks at the registered domain around it, on Pro and Business, from public data only: certificate transparency logs and ordinary DNS lookups. Nothing is probed or scanned, and no names are guessed from wordlists.
| Watch | Plan | How often | On by default |
|---|---|---|---|
| Subdomains and dangling records | Pro and Business | Daily | No |
| Lookalike domains | Pro and Business | Daily | No |
The domain is the one the daily expiry check found at the registry (www.shop.example.co.uk watches example.co.uk), so monitors of example.com and www.example.com watch the same domain, and it is read once a day however many monitors and workspaces watch it. Like website changes, these alerts never mark the website down, open an incident or show on its status pages, and the first look at anything only records it: the subdomains found on the first day and each lookalike's first lookup. Both show under Domain watch on the monitor's page, after Website changes, and turn on or off in the monitor's settings under Also alert on (subdomain_alerts and lookalike_alerts in the API).
Subdomains and dangling records
Certificate authorities log every certificate they issue in public certificate transparency logs, so the names in those certificates show which subdomains a domain uses. Once a day UpHeron reads the names logged under the domain from crt.sh, Sectigo's search of the logs, and looks each up on public DNS resolvers (1.1.1.1 and 8.8.8.8). The monitor's page lists them with where each points: its CNAME chain and addresses. A new subdomain alerts, with where it points.
crt.sh can be days or weeks behind the logs, so a new subdomain can take a while to appear, and its alert may come well after its certificate was issued. Subdomains that never had a certificate of their own (one covered by a wildcard, or served over plain HTTP) are not in the logs and are not listed.
A newly watched domain is first read within a day, at a time of day its name decides, and then daily at that time, so the reads of many domains spread over the day. When crt.sh does not answer or limits requests, it is asked again a few hours later; nothing alerts because it was down. A domain with more than 1,000 names in certificates keeps the first 1,000.
A subdomain whose CNAME points at a third-party service where nothing is set up any more is a takeover risk: anyone who claims that bucket, app or page on the service serves pages on your subdomain. UpHeron alerts when a subdomain's CNAME points at a service known for this and the service reports no site there:
- the service's name no longer exists (DNS answers NXDOMAIN), for services where that is the sign: Azure, AWS Elastic Beanstalk, Discourse; or
- one ordinary HTTPS request to the subdomain, at its own address, returns the page the service shows for an address nobody has set up, such as Amazon S3's "The specified bucket does not exist". The service's certificate rarely covers your name, so it is not checked; only the page's text is read.
The alert says what was observed, with the evidence, and no more. Remove the DNS record if the service is no longer used, or set the site up on the service again. The services and their fingerprints come from the can-i-take-over-xyz project by EdOverflow and contributors (CC BY 4.0): only those it lists as vulnerable with a specific fingerprint (Agile CRM, Airee.ru, Amazon S3, Anima, AWS Elastic Beanstalk, Bitbucket, Discourse, Gemfury, Ghost, HatenaBlog, Help Juice, Help Scout, JetBrains YouTrack, Microsoft Azure, ngrok, ReadMe, Strikingly, Surge.sh, SurveySparrow, Uberflip, UptimeRobot, WordPress.com, Worksites).
At most 250 subdomains are looked up per domain, the most recently found first; the monitor's page says when a domain has more. Wildcard names (*.example.com) are listed but cannot be looked up.
Lookalike domains
On Pro and Business, UpHeron makes the likely typo and look-alike spellings of the domain, at most 300:
- a letter left out (
exmple.com), two letters swapped (exmaple.com), a letter doubled (exaample.com), a neighbouring key (exampke.com), a hyphen (exam-ple.com) and the missing dot ofwwwexample.com; - letters that look alike:
rnform,0foro,1forl; - the same name under other common top-level domains (
example.net,example.co); - internationalized names with Cyrillic letters that look like Latin ones (
еxample.com, registered asxn--xample-2of.com).
Each is looked up once a day, a twenty-fourth of them every hour, and alerts when one that did not exist starts resolving, or gains mail servers (MX records): someone may be setting it up for phishing. The alert gives its addresses, mail servers and, when the registry publishes it over RDAP, the date it was registered. Spellings that are registered are listed on the monitor's page. Mark one as yours, or ignore it, and it no longer alerts your workspace.
DNS lookups for all domain watches are paced for the whole service, so a workspace with many monitors cannot make it flood the resolvers: when the hour's lookups run out, the rest wait for the next hour.
API and MCP
GET /api/v1/monitors/{id}/domain-watch returns the domain, the subdomains with where each points, any takeover evidence and when the names were last read (read_at), and the registered lookalikes with their mark. PUT /api/v1/monitors/{id}/domain-watch/lookalikes/{name} with {"mark": "mine"}, {"mark": "ignored"} or {"mark": null} marks a lookalike (Pro and Business). Alerts reach webhooks with "event": "domain_watch".
MCP clients have get_domain_watch.