Phylex Watch monitors your whole domain every day, not just the applications you have added as assets. Watch finds forgotten subdomains, tells you when something changes, and detects warning signs such as injected online-gambling spam (known in Indonesia as judol), defacement, risky open ports, and lookalike domains. Phylex Watch is currently open as a limited trial.

The console is currently in Indonesian. Button names are given in English with the Indonesian label where useful.

Watch and Scan

  • Phylex Scan tests the applications you added as assets for vulnerabilities (OWASP Top 10, TLS, email, and more).
  • Phylex Watch monitors your attack surface from the outside: what is visible on the internet under your domain, and what changes. Subdomains Watch finds can be added to Scan as assets in one click.

In short: Scan checks what you know, Watch guards what you forgot. Start with Scan if you have one or two applications. Add Watch when a scan turns up a subdomain you do not recognise, your site has been injected with gambling content or defaced, your domains and apps keep growing, or auditors ask for evidence of continuous monitoring.

1. Set up a project and turn on Watch

  1. Make sure your organization has Phylex Watch. If not, the organization owner opens the product menu at the top left of the console → Other products (Produk lain) → Watch → Request (Ajukan), or emails business@foiniks.com. Once enabled, a Watch tab appears next to Scan.
  2. Watch works per project. Pick a project (for example one application or one brand) and make sure its root domain is set, for example company.com. Only organization owners can create or edit projects.
  3. Click Turn on Watch (Nyalakan Watch). The first run happens within an hour (or click Check now / Periksa sekarang) and becomes the baseline; later changes are recorded as events.

The schedule is automatic, with no time to choose: full asset discovery once a day at night (Jakarta time), and DNS, front pages, and ports & services every 6 hours.

2. Verify the root domain

Without verification, Watch only uses public sources (Certificate Transparency logs, DNS, and registrar data) and never contacts your servers. For gambling-spam, defacement, and port checks, prove you own the root domain:

  1. Add a DNS TXT record named _phylex-watch.company.com with the value phylex-watch=<token> (the token is shown on the Root domain card).
  2. Click Check verification. If the domain is already a Scan asset verified by DNS, no new record is needed; just click Check.

Verified domains are marked ✓ at the top of the Watch page.

3. What is monitored

  • Attack surface (EASM): new or removed subdomains, changed CNAMEs, subdomain takeover risk (a CNAME still pointing to a deleted service), expiring certificates and domains, certificates from a new CA, and email DNS changes (SPF, DMARC, MX).
  • Gambling spam & defacement (needs verification): gambling keywords, hidden content, cloaking shown only to Googlebot, gambling subdomains, defacement signs, and new scripts. Watch opens each subdomain's front page as a normal visitor and as Googlebot, plus up to 8 pages from sitemap.xml once a day. Only short text snippets are kept as evidence.
  • Ports & services (needs verification): risky or newly opened ports on the origin server. Servers behind a CDN such as Cloudflare are skipped because their origin ports are not visible from the internet.
  • Critical threats: lookalike domains, hosts on a malware blocklist (URLhaus), the number of employee or user accounts stolen by infostealer malware (weekly, counts only), and service versions with actively exploited flaws (CISA KEV). Lookalike domains that are only parked at a registrar are not treated as threats.

4. Reading the Watch page

The Watch menu has Overview, Timeline, Inventory, and Gambling (Ringkasan, Linimasa, Inventaris, Judol).

  • Attack surface Orbit: your root domain in the centre, with subdomains, IPs, and services orbiting around it. Click a point to jump to its row in the Inventory. Next to it are four numbers: active hosts, new exposure (7 days), high risks, and certificates expiring within 30 days.
  • The Critical threats, Gambling & defacement, and Ports & services cards show open events, or a clean status with the last check time.
  • Change timeline: every event, most severe first. Click Mark as known (for example a subdomain your team owns) or Resolved after fixing; both require a note for the audit trail. Reopen undoes it. Some events (certificates, domains, takeover risk) close automatically when the condition clears.
  • Inventory: every host per root domain, with its address, page status, and certificate days left. Twin hosts are several hosts serving the same site. Click Add asset to scan a host with Phylex Scan.

5. Email notifications

Every organization member gets an email for each new event (on the first run, only Medium risk and above). The subject starts with PENTING (important) when there is a high risk, such as gambling spam, defacement, or a subdomain that can be taken over. Emails do not include full evidence; open the console for details.

If gambling spam or defacement is found

  1. Open the event in the Timeline and review the URL and evidence snippet. Check the Googlebot view too, as gambling injections are often shown only to search engines.
  2. Secure the server: change admin and hosting passwords, update your CMS and plugins, remove unknown files or scripts, and look for admin accounts you do not recognise.
  3. Click Check now to confirm the indicators are gone, then mark the event Resolved with a note on what you did. For a full clean-up, contact the Phylex team through a ticket.