Watches

A watch tells subpoof to monitor a domain (or a search term) over time and alert you when new things appear.

What a watch does

Once a day, subpoof's watch checker walks every active watch and, depending on the watch type, runs:

• Domain watch: a fresh scan against the watched root domain. The new result is diffed against the previous scan; any newly-discovered subdomain triggers an alert.
• Label watch: a sweep across every scan in the platform looking for the watched subdomain label (e.g. vpn) on roots that did not have it yesterday.
• Search watch: replays a saved dictionary search; alerts when a new label matches the same filters.

Setting up a watch

From the dashboard, hit /watches. Paste a root domain or label and submit. From the dictionary page, individual labels have a "Watch" button.

How alerts arrive

By default, alerts arrive at the email address you signed in with. The watch detail view shows alert delivery state per watch - whether it is on, what address receives it, and the last delivery status.

If you do not want alerts in your inbox, the watch UI lets you toggle alert delivery off; subpoof still records the diff but does not send mail.

Daily check schedule

Watches run once per day. You will see at most one alert per watched domain per day, even if multiple new subdomains appeared during that 24-hour window - they are batched.

Stopping a watch

Click the watch on the /watches page and remove it. Already-delivered alerts are kept in your audit log; future days no longer trigger.

Watches do not cost extra to run

A watch is a scheduled scan. Scans on watched domains count against your scan quota the same way ad-hoc scans do. See billing for plan limits.