ShadowTrackr

Log in >
RSS feed

Tricky new feature: ignore some of your urls

04 February 2019
If you have lots of urls, not all of them will be equally interesting. Some might be for testing, and some might not even be yours to worry about. I've been thinking about creating some form of order for assets, but haven't really figured out a good solution yet. You don't want to be hacked through a test server just because you missed a warning. If it's yours, and it has a problem, then ShadowTrackr should let you know.

There are some edge cases where you might want to ignore a url. Imagine you own and run the pay level domain shadowtrackr.com, but have one of your subdomains contracted out to another party (something like thirdparty.shadowtrackr.com). That other party runs the server for it, and you agreed that they do their own security and monitoring. Anything related to this subdomain is now just noise on your timeline, and if you have lots of these subdomains, you might not see the forest for the trees on your timeline.

For this specific problem, you can now ignore a url. The option is available on the url page (go to assets and click on the edit link next to the url). From the moment you set a url to ignore, no new data is logged for it and no alerts will be sent. The historical information will still be available but no longer be updated. If the ignored url pops up in search results it will be marked as 'ignored' in red letters. The ignored urls (if you have them) are shown at the bottom of the url tab on your assets page.

If you have lots of subdomains that you need to ignore , setting each and everyone to ignored by hand is no fun. For this, there is a shortcut called the ignore list. If you have more than 10 subdomains you will see a link "ignore list" next to the pay level domain when you click it open (with the +) on the assets page.

Before you go ignoring some of your urls, be warned: you should only ignore urls if you are absolutely sure they pose no risk or someone else is monitoring them. Even if it's just a historic url or currently nothing runs on it, someone could hijack or spoof the DNS record, put a website on it and start phishing you users or spamming the world. It wouldn't be the first time this happened.
Older posts >

Resources
API
Blog
Documentation
Integrations
Shodan
OpenCTI