Get alerted when your dApp's domain or frontend changes hands
Front Sentinel watches your registrar, nameservers, certificates and the JavaScript your users load, and tells your team when any of it changes.
- Registry/registrar lock removed: clientTransferProhibited
- Delegation at registry changed: ns1.registrar-dns.net -> ns1.unknown-host.io
- New certificate for app.example.xyz by R11 (CA not seen before for this domain)
Example of the alert format. Each line is a separate check; together they become one critical alert.
Free, no sign-up. Checks registrar locks, DNSSEC, CAA, expiry, nameserver consistency, SRI and CSP.
How frontends get taken over
Attackers don't need to break your contracts. They take control of the domain at the registrar or DNS provider, point it to their own server, get a certificate and serve a wallet drainer under your name. Users sign because the URL is right. A second path is a third-party script your page loads: if its publisher is compromised, the code changes while the URL stays the same.
- A malicious version of the Connect Kit library was published to npm and loaded by dApps that used the Connect Kit loader, without any change on the dApps' side.
- Squarespace reported unauthorized changes to domain settings and DNS records of cryptocurrency-related domains. Pendle's bot detected a malicious DNS record and the team regained control in about 40 minutes; Celer's domain monitoring intercepted an attempted takeover; Compound's site was compromised and later restored.
- An attacker gained access to the systems of Curve's registrar and pointed the curve.fi delegation to their own DNS server.
- The projects' centralized domains were hijacked, two years after their frontends were compromised in late 2023.
What gets watched
| Registry and registrar | Transfer and update locks removed, registrar changed, transfer started | critical |
|---|---|---|
| Delegation (nameservers) changed at the registry | warning | |
| Expiry in less than 45 days; less than 14 days | warning, critical | |
| DNS, from Cloudflare, Google and Quad9 | NS, CAA or MX records changed; resolvers disagree on NS | warning |
| DNSSEC switched off (DS record removed) | critical | |
| A/AAAA address changed | info | |
| Certificate Transparency | New certificate for the domain or a subdomain from a CA it hasn't used before | warning |
| Frontend scripts | Third-party script content changed at the same URL | critical |
| Page loads scripts from a new host | warning | |
| Correlation | New certificate plus a nameserver, registrar or lock change: one possible hijack alert instead of several separate ones | critical |
Alerts
Telegram, email, Discord or Slack webhook, or a JSON webhook to your own system. Each channel has its own minimum severity. The free plan monitors one domain; paid plans open soon.