Redoubt

Redoubt takes a list of URLs you own, runs on a schedule, and answers one question: has anything moved since last time? A run where nothing changed sends nothing at all. A tool that reports every run is a tool people stop reading, and a tool nobody reads detects nothing.

Twelve checks run. Eight of them need no API key and no permission from anyone, because they measure the domain directly instead of asking a third party for an opinion about it. Liveness first, then TLS expiry and chain trust, then certificates logged for your domain that nobody requested: an unrequested certificate is either a misconfiguration or an attack, and the transparency logs are where it becomes visible before the damage is done. DNS is treated the same way, with NS, MX, A and AAAA records compared against a baseline alongside SPF and DMARC validity, because a changed MX record means mail is going somewhere you did not choose and a reputation feed will not say so for hours.

The rest look at the page itself. Missing security headers, and cookies without Secure or HttpOnly, judged against your policy rather than someone else’s letter grade. Script and stylesheet digests compared run to run, so an injected skimmer shows up as a changed hash. Probes for files that should never be reachable, like /.git/config and /.env. And Mozilla’s HTTP Observatory, turned into a pass or fail against a threshold you set.

The other four read reputation reports that already exist: VirusTotal, Google Safe Browsing, URLhaus and URLScan.io. None of them ever submits your URL for scanning, so monitoring a page can never be the thing that publishes it. A source with no key configured skips with a warning naming the variable it is still waiting on, rather than failing the run, so you can list every source up front and add keys as you get them.

The DNS and certificate-transparency baselines live in config.yaml, which is committed to version control. A legitimate change to your name servers or your certificate authority is a reviewed commit to that file, and anything that turns up without one is an alert. Recoveries are reported as clearly as breakages, since a tool that only reports breakage never tells you it is over.