Domain watcher

Two-stage alerts: ≤30 days before expiry as warning, ≤7 days as critical. Only one open expiry alert per domain at a time; it auto-resolves as soon as the remaining validity exceeds 30 days again after renewal.

A registrar change (e.g. IONOS → GoDaddy) is logged with before/after values in the changelog — a typical hijacking signal that should be investigated manually.

Nameservers determined via a native DNS query (NS records) are compared against the previous snapshot. NS changes are written to the changelog (warning severity).

The agent captures a DNS snapshot (A, AAAA, MX, NS, TXT and more) and compares it against the previous state on each run. When a record type changes, a changelog entry with before/after values is created. A, AAAA and NS changes are classified as warning (a potential hijacking/redirection indicator), MX and TXT changes as info. The query interval is 24 hours on the Free plan and 6 hours on paid plans.

Registrar changes, expiry thresholds (30/7 days crossed), nameserver and DNS-record changes all flow into the same website changelog. Each entry carries change type (domain/dns), field, before/after value, severity and detection time — an auditable history instead of scattered one-off notices.

Generates typo and bit-squat variants for each monitored domain (xictrqa.com, xictraq.co, xictraq-login.com, ASCII homoglyphs such as rn→m, l→1, o→0 …) and checks daily via DNS which were registered. Registered lookalikes are enriched automatically: registrar (RDAP), SSL certificate status and a phishing risk score (0–100, heuristic from variant type, valid SSL and HTTP reachability). Newly registered lookalikes trigger an alert whose severity follows the score (≥70 critical, ≥50 warning, else info). Early detection of phishing infrastructure. Scan endpoint: `POST /api/websites/{id}/lookalikes/scan`, daily cron re-scans.

Every publicly trusted TLS certificate ends up in the Certificate Transparency logs (CT logs) — XICTRAQ evaluates them as a technical source via crt.sh. Newly issued certificates are matched against your brand: against the apex (your own domain/subdomains), against lookalike variants and against brand keywords. Each match carries a `match_kind` rating — `exact` (your own domain/subdomain), `lookalike` (typo variant), or `substring` (your brand inside a foreign host name) — and a risk score from 0–100 built from several risk factors. Matches with a score of 50 or higher trigger a one-time alert. Because a phishing certificate is often issued hours or days before the attacker's domain even resolves in DNS, the CT watch is a genuine early warning. In parallel, XICTRAQ keeps your own certificate inventory (`is_own`): every certificate issued for your domain — ideal for surfacing shadow IT and forgotten subdomain certificates. Endpoints: `GET /api/websites/{id}/ct-watch` (matches + own inventory), `POST /api/websites/{id}/ct-watch/scan` (manual run, returns `checked`/`matched`/`newly_flagged`/`own_certs`) and `POST /api/websites/{id}/ct-watch/dismiss` (dismiss a match). Plus a daily cron reconciliation.