Know first when something changes on your domain.
Phylex Watch monitors your whole domain every day, not just the applications you remember. It finds forgotten subdomains, detects injected online-gambling spam and defacement, risky ports, and critical threats, then alerts you before customers or search engines notice.
The trial is open to a limited number of organizations. Our team will contact you with a quote.
What is monitored
Attack surface (EASM)
New or removed subdomains from Certificate Transparency logs and DNS, changed CNAMEs, subdomain takeover risk, expiring certificates and domains, and email DNS changes.
Gambling spam & defacement
Gambling keywords, hidden content, cloaking shown only to Googlebot, gambling subdomains, defacement signs, and new scripts. Pages are checked as a visitor and as Googlebot.
Ports & services
Risky or newly opened ports on the origin server, every 6 hours. Servers behind a CDN are skipped because their origin ports are not visible from the internet.
Critical threats
Lookalike domains, hosts on a malware blocklist, the number of accounts stolen by infostealer malware, and service versions with actively exploited flaws (CISA KEV).
Scan or Watch?
Scan checks what you know. Watch guards what you forgot.
| Phylex Scan | Phylex Watch | |
|---|---|---|
| The question it answers | How vulnerable are the applications I registered? | What is visible on the internet under my domain, and what has changed? |
| Coverage | The assets you add: websites and APIs, including areas behind a login | Your whole parent domain and every subdomain, including ones never registered |
| How it works | Scheduled vulnerability testing (OWASP Top 10, TLS, headers, email domain) | Automatic monitoring: daily asset discovery, home page and ports every 6 hours |
| Output | Findings report with fixes (PDF, CSV, MD, JSON) for audits, clients, or tenders | Email alerts when something changes, an event timeline with triage notes |
| Best when | You are building or releasing an application and need a security report | You have many domains, were hit by gambling injection or defacement, or are unsure which assets are exposed |
Signs you are ready for Watch
- A scan or one of our checks found a subdomain or server you did not recognise.
- Your site, or a site in your sector, was injected with online gambling content or defaced.
- Domains, apps, or branches keep growing and a manual asset list no longer keeps up.
- Auditors or management ask for evidence of continuous monitoring, not just a point-in-time report.
They work together: subdomains Watch discovers can be scanned with Phylex Scan in one click. See Phylex Scan
How it works
Pick a root domain
Create a project in Phylex Console and set its root domain, for example company.com. Watch starts working from public sources right away.
Verify the domain
Add one DNS TXT record so Watch may open pages and check ports on your servers.
Get alerts
Watch runs automatically every day. Every change is logged in the timeline and emailed, with an IMPORTANT subject for high risks.
One view of your whole attack surface
- Attack-surface Orbit: root domain, subdomains, IPs, and services in one picture.
- An event timeline with triage and notes for the audit trail.
- A host inventory per domain, including twin hosts serving the same site.
- Discovered subdomains can be scanned with Phylex Scan in one click.
FAQ
How is it different from Phylex Scan?
Phylex Scan tests the applications you have added for vulnerabilities. Phylex Watch monitors everything visible on the internet under your domain, and what changes, every day. They complement each other.
I already use Phylex Scan. Do I still need Watch?
Scan only tests the assets you register. Old subdomains, test servers, or third-party services under your domain that were never added stay invisible to it. Watch finds those assets and tells you when something changes, and you can then scan them with Scan.
I only have one website. Where should I start?
Start with Phylex Scan, which has a free 7-day trial. Watch pays off most when you have many domains, they change often, or you have been targeted by gambling injection or defacement.
Does Watch put load on my servers?
No. Without verification Watch only reads public sources. After verification it opens a few pages per host per day like a normal visitor and checks common ports every 6 hours, without attack tests.
How much does it cost?
Phylex Watch is currently in a limited trial. Request a trial with the form on this page and our team will contact you with a quote based on your number of domains.