Watch lists
A watch list monitors a collection of known targets for changes. Choose DNS, HTTP, Ports or Certificate monitoring for each list, add targets, and Shadowspotter checks them in the background at your chosen interval. Changes are saved in an event history and can trigger notifications. Detections can feed newly discovered domains into watch lists automatically.
Creating a watch list
- Open Watch Lists in the navigation and click Create new Watch List.
- Choose DNS, HTTP, Ports or Certificate.
- Give the list a name, set its check interval, and configure the options for that type.
- Select any notification channels, choose when to notify, and click Save changes.
- Use Add Domain or, for a Ports list targeting ranges, Add IP Range.
The monitoring type is fixed when you create the list. Ports lists also keep their original target kind (domains or IP ranges). Create another list to monitor the same target in a different way.
Common settings
| Field | Description |
|---|---|
| Name | A label shown with the monitoring type, for example HTTP: Brand impersonation. |
| Check interval | Minutes between scheduled checks. Defaults to 60; the minimum depends on your subscription and the maximum is 1440 (one day). Checks run when due, so the interval is not an exact delivery time. |
| Active | Enables scheduled checks. Deactivating a list pauses monitoring and releases its watch quota while keeping targets and history. |
| Shared | Makes the list and its history visible to other members of your organization. They can select an active shared domain list for detection auto-watch; editing the list and manually adding or removing its targets remain with its owner. |
| Notifications | Optional channels to receive alerts. Choose from active notifications you own or those shared with your organization. Hold Ctrl/Cmd to select several. Leave empty to keep history without sending alerts. |
| Notify on | Filters which recorded changes produce alerts. See notification modes. |
| Deduplicate by domain | Enabled by default. Each selected channel sends once per domain in this list, including future checks. Turn it off to receive every eligible change. Applies to domain targets only. |
Monitoring types
DNS
Checks A, AAAA, NS, MX,
CNAME and TXT records and records additions, removals
and replacements. There are no extra settings for this type.
A DNS timeout is treated as unknown rather than as records disappearing.
HTTP
Tracks website availability, HTTP status codes, keyword matches and optional screenshot changes. All domains in the list use the same URL settings.
| Option | Behavior |
|---|---|
| URL to check | Choose http or https (default), an optional port, and an optional path. Blank port uses the scheme's default; blank path checks the homepage. With HTTPS, port 8443 and path /login, a target example.com is checked at https://example.com:8443/login. HTTP and screenshot checks use this URL. |
| Keywords | Comma-separated text, for example login, password, verify. Matching is case-insensitive substring matching in the page body. Both newly matching and disappearing keywords are recorded. |
| Compare screenshots | Captures screenshots and compares their visual similarity with the previous successful screenshot. Disabled by default. |
| Screenshot similarity threshold | A change is recorded when similarity falls below this percentage. Defaults to 92%. Higher values detect smaller visual differences; 100 detects any difference in the visual hash and 0 disables screenshot change events. Choose All changes to receive screenshot alerts. |
An HTTP response, including an error status such as 404, means the site is reachable. A transition to offline requires two target failures with no successful probe; a successful HTTP or enabled screenshot check marks it online immediately. Monitoring service failures preserve the last known availability instead of marking the target offline.
Ports
Monitors whether TCP ports accept connections. Enter comma-separated port
numbers from 1 to 65535, for example 22, 80, 443, 3389.
Opening and closing transitions are recorded per target and port.
A port is marked closed after two failed connection observations; a successful
connection marks it open immediately. Scan service failures keep the previous state.
At creation, choose Domains or IP ranges as the target kind.
Range lists check every address in each CIDR, including network and broadcast
addresses. Each entry can contain at most 256 addresses: IPv4 /24
or a smaller range, or IPv6 /120 or a smaller range. A single IP
address is also accepted.
Scan rate limits addresses scanned per minute for scheduled IP-range
checks. It defaults to 600; 0 means unlimited. It does not affect
domain targets. Domain results from searches or detections can only be added
to lists targeting domains.
Certificate
Monitors newly observed certificates in Shadowspotter's Certificate Transparency data without probing the target's TLS service. Matches include the domain itself and a wildcard covering it. Enable Also cover subdomain certificates to include names beneath the watched domain. A certificate covering several matching names is grouped into one change, including the issuer and validity dates.
The first check establishes a starting point; existing certificates do not trigger alerts. Later checks report newly observed certificates after that point. This monitors issuance observed through Certificate Transparency, rather than certificate deployment or expiry on a live server.
Adding targets
- From the list: click Add Domain and enter a hostname such as
example.com, without a scheme or path. IP-range lists provide Add IP Range instead. - From search results, a domain page or detection results: use Add to watch list and choose one of your domain lists. The picker also links to creating a list; reload its choices after creating one.
- Automatically from a detection: select one or more active domain lists in Auto-watch results on the detection form. New results add their domains while quota is available. Existing results are not backfilled. Active domain lists shared by your organization are also available.
Adding a domain already in the same list does not create a duplicate or use more quota. The same domain can belong to several lists, for example one DNS list and one HTTP list. Detection notifications can report the initial match while watch list notifications independently report subsequent changes.
Notification modes and deduplication
Notify on controls which changes are sent to the selected channels. Every detected change remains in the event history, including changes excluded from notifications.
| Mode | Changes that can notify |
|---|---|
| All changes (default) | Every recorded change for the list's monitoring type. |
| Positive changes only | DNS changes that add at least one record, sites coming online, ports opening, new keyword matches and new certificates. DNS replacements qualify if a new value appears. HTTP status and screenshot changes are excluded. |
| New keyword matches only (HTTP only) | A configured keyword changing from absent to present. Add keywords to use this mode. Availability, status codes, screenshots and disappearing keywords do not notify. |
Deduplication is tracked separately for each list, channel and domain, and only successful sends count. Another list can alert on the same domain through the same channel. Removing and re-adding a domain to the same list does not reset its delivery history. IP-range targets bypass domain deduplication. A notification channel's detection deduplication setting is separate from the watch list's setting.
Alerts include the eligible changes and links to the watch list and the specific event. See Notifications to configure email, Slack and other available channels.
Checks and change history
A target's first check establishes a baseline silently. Later checks compare observations with that baseline; an event is created when a change is detected. New targets in active lists are picked up in the background without waiting for the full check interval. Use Last checked to see their progress.
Search the target table by domain or range, sort by target, added date or last checked date, and page through longer lists. HTTP lists also show and sort by online status. With screenshot comparison enabled, switch between Table and Tiles; tiles show the latest screenshots, status and check time. Click a screenshot to view it at full size.
Recent Changes shows the latest 50 events across the list. Open a target to explore its change history graph. Select a point to inspect the saved result and the old and new values at that check. HTTP results can include response metadata, the page body and screenshots when available.
Click Check now on a target's detail page to run an immediate check. This updates the baseline and records any changes without sending notifications. Manual range checks also bypass the scan rate limit.
Quotas and removing targets
Watch lists require a subscription with watch access. Quota counts targets in
active lists, rather than the number of lists: each domain costs one unit per
list, and an IP range costs its total address count. For example, an IPv4
/24 costs 256 units, and the same domain in a DNS list and an HTTP
list costs two. Organization members share the available quota across their
active lists, including unshared lists.
Inactive lists use no watch quota and can still hold targets. Reactivating a list requires enough quota for all its targets. When quota is exhausted, manual additions to active lists are rejected and automatic additions from detections are skipped.
Use a target's remove action to stop watching it and delete its event history from that list. Delete watch list removes the whole list, its targets and history. Deactivate a list when you want to pause checks and preserve its history.