SubWatch is a lightweight Bash script that automates subdomain monitoring using subfinder, anew, and notify. It scans your target domains every 6 hours and sends newly discovered subdomains as text and file alerts to your Discord channel — perfect for bug bounty, red team, and recon workflows.

 _____ __ _ __ __ __
 / ___/__ __/ /_| | / /___ _/ /______/ /_
 \__ \/ / / / __ \ | /| / / __ `/ __/ ___/ __ \
 ___/ / /_/ / /_/ / |/ |/ / /_/ / /_/ /__/ / / /
 /____/\__,_/_.___/|__/|__/\__,_/\__/\___/_/ /_/

 Made with ❤️ by Brut Security

• ⏱️ Runs automatically every 6 hours
• 🧠 Tracks and stores unique subdomains per domain
• 📨 Sends text + file notifications to Discord
• ⚙️ Uses subfinder, anew, jq, and notify
• ✅ Clean, fast, and automation-ready

You must install the following tools before running SubWatch:

• subfinder – for subdomain enumeration
• anew – for deduplication
• jq – for parsing JSON
• notify – for Discord notifications (text + file) ✅

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/tomnomnom/anew@latest
go install -v github.com/projectdiscovery/notify/cmd/notify@latest
sudo apt install jq

Ensure your $GOPATH/bin is in your $PATH so all tools work globally.

You must export your Discord Webhook:

export DISCORD_WEBHOOK="https://discord.com/api/webhooks/XXXX/XXXX"

1. Clone the Repo

git clone https://github.com/Brut-Security/subwatch.git
cd subwatch

2. Create domains.txt

Add target domains (one per line):

example.com
testsite.org

3. Configure notify with Discord Webhook

nano /.config/notify/provider-config.yaml

Add your Discord webhook and name the provider subdomains (this ID is used by the script).

Example config snippet:

discord:
 - id: "subdomains"
 webhook_url: "https://discord.com/api/webhooks/XXXX/XXXX"

4. Make the Script Executable

chmod +x subwatch.sh

Run the script:

./subwatch.sh

It will continuously run, scanning every 6 hours, and only notify when new subdomains are found.

Watch the video

• Subdomain lists are stored as <domain>-list.txt
• New subdomains (if found) are:
  • Appended to the list
  • Saved to a temp .txt file
  • Sent to Discord using notify as both:
    • 💬 Message content
    • 📎 File attachment

🚨 New subdomains detected for `example.com` (3):
• api.example.com
• dev.example.com
• staging.example.com

📎 A .txt file is also sent with full subdomain list for easy access.

Watch the video

Made with ❤️ by Brut Security
Join us for practical cybersecurity training, tools, and community.

• 🌐 brutsec.com
• 🐦 Twitter
• 💼 LinkedIn
• 📱 Telegram
• 📧 info@brutsec.com

MIT License — see LICENSE for details.