> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # FBI Watchdog: An OSINT Tool That Monitors Domain Seizures and DNS Record Changes in Real Time, Alerting Users to Law Enforcement Takedowns and Other DNS Modifications - URL: https://darkwebinformer.com/fbi-watchdog-an-osint-tool-that-monitors-domain-seizures-and-dns-record-changes-in-real-time-alerting-users-to-law-enforcement-takedowns-and-other-dns-modifications/ - Published: 2025-02-05T20:45:44.000Z - Updated: 2025-09-04T22:24:10.000Z - Author: Dark Web Informer - Tags: OSINT, Tools ## **This post is best seen on the website!** --- GitHub: Version: 1.0 Release Date: 5th of February 2025 --- # FBI Watchdog [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#fbi-watchdog) 🛡️ FBI Watchdog is a cyber threat intelligence OSINT tool that monitors domain DNS changes in real-time, specifically detecting law enforcement seizures (`ns1.fbi.seized.gov` and `ns2.fbi.seized.gov`). It alerts users via Telegram and Discord and captures screenshots of seized domains. ![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2025/02/FBI_Watchdog-2.png) ✅ FBI Watchdog is clean! No detections on VirusTotal. Check the latest scan report here: [VirusTotal Report](https://www.virustotal.com/gui/file/87466e912dcf3b3439c02bf6208703def32e864cd2bcecd47763277193f2241f) 🚨 **Live in Action**: FBI Watchdog is actively monitoring domains on **my Telegram channel**: [TheDarkWebInformer](https://t.me/TheDarkWebInformer). 🔍 **Want Cyber Threat Intelligence updates?** Visit [**DarkWebInformer.com**](https://darkwebinformer.com/) for real-time insights on data breaches, data leaks, ransomware and more dark web threats. --- ## 📸 FBI Watchdog in Action [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#-fbi-watchdog-in-action) ### 🔍 Checking DNS [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#-checking-dns) | **DNS Checking** | **More DNS Checking** | **DNS Checking Finished** | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [![DNS Checking](https://github.com/DarkWebInformer/FBI_Watchdog/raw/main/images/dns_checking.png)](https://github.com/DarkWebInformer/FBI%5FWatchdog/blob/main/images/dns%5Fchecking.png) | [![DNS Checking](https://github.com/DarkWebInformer/FBI_Watchdog/raw/main/images/dns_checking1.png)](https://github.com/DarkWebInformer/FBI%5FWatchdog/blob/main/images/dns%5Fchecking1.png) | [![DNS Check Complete](https://github.com/DarkWebInformer/FBI_Watchdog/raw/main/images/dns_checking_finished.png)](https://github.com/DarkWebInformer/FBI%5FWatchdog/blob/main/images/dns%5Fchecking%5Ffinished.png) | | *Checking for DNS Record Changes* | *Checking for More DNS Changes* | *DNS Checking Completed* | ### ⚠️ Detecting DNS Changes & Seizure Capture [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#%EF%B8%8F-detecting-dns-changes--seizure-capture) | **DNS Changes Alerted** | **Seizure Page Captured** | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [![DNS Change](https://github.com/DarkWebInformer/FBI_Watchdog/raw/main/images/dns_change_detected.png)](https://github.com/DarkWebInformer/FBI%5FWatchdog/blob/main/images/dns%5Fchange%5Fdetected.png) | [![Seizure Capture](https://github.com/DarkWebInformer/FBI_Watchdog/raw/main/images/seizure_screenshot_taken.png)](https://github.com/DarkWebInformer/FBI%5FWatchdog/blob/main/images/seizure%5Fscreenshot%5Ftaken.png) | | *Detected DNS Record Change* | *Captured LEA Seizure Page* | ### 📲 Telegram Notifications [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#-telegram-notifications) | **DNS Change Alert** | **Seizure Alert** | **Seizure Screenshot** | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [![Telegram DNS Change](https://github.com/DarkWebInformer/FBI_Watchdog/raw/main/images/telegram_notification.png)](https://github.com/DarkWebInformer/FBI%5FWatchdog/blob/main/images/telegram%5Fnotification.png) | [![Telegram Seizure](https://github.com/DarkWebInformer/FBI_Watchdog/raw/main/images/telegram_seizure_dns_detected.png)](https://github.com/DarkWebInformer/FBI%5FWatchdog/blob/main/images/telegram%5Fseizure%5Fdns%5Fdetected.png) | [![Telegram Seizure Screenshot](https://github.com/DarkWebInformer/FBI_Watchdog/raw/main/images/telegram_seizure_high_res_screenshot.png)](https://github.com/DarkWebInformer/FBI%5FWatchdog/blob/main/images/telegram%5Fseizure%5Fhigh%5Fres%5Fscreenshot.png) | | *DNS Changes Sent to Telegram* | *Discord LEA Seizure Notification* | *Telegram Seizure Screenshot* | ### 🔔 Discord Notifications [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#-discord-notifications) | **DNS Change Alert** | **Seizure Alert** | **Seizure Screenshot** | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [![Discord DNS Change](https://github.com/DarkWebInformer/FBI_Watchdog/raw/main/images/discord_notifcation.png)](https://github.com/DarkWebInformer/FBI%5FWatchdog/blob/main/images/discord%5Fnotifcation.png) | [![Discord Seizure](https://github.com/DarkWebInformer/FBI_Watchdog/raw/main/images/discord_seizure_dns_detected.png)](https://github.com/DarkWebInformer/FBI%5FWatchdog/blob/main/images/discord%5Fseizure%5Fdns%5Fdetected.png) | [![Discord Seizure Screenshot](https://github.com/DarkWebInformer/FBI_Watchdog/raw/main/images/discord_seizure_high_res_screenshot.png)](https://github.com/DarkWebInformer/FBI%5FWatchdog/blob/main/images/discord%5Fseizure%5Fhigh%5Fres%5Fscreenshot.png) | | *DNS Changes Sent to Discord* | *Telegram LEA Seizure Notification* | *Discord Seizure Screenshot* | --- ## 📌 Features [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#pushpin-features) - ✅ **Real-time DNS Monitoring** – Detects changes in `A`, `AAAA`, `CNAME`, `MX`, `NS`, `SOA`, and `TXT` records. - ✅ **Seizure Detection** – Identifies law enforcement takeovers (`ns1.fbi.seized.gov and ns2.fbi.seized.gov`). - ✅ **Telegram & Discord Alerts** – Sends detailed notifications when a DNS change occurs or a domain is seized. - ✅ **Screenshot Capture** – Uses **Selenium** to take snapshots of affected sites. - ✅ **Rich CLI Output** – Uses **`rich`** for colored logs and better visibility. - ✅ **Auto-Saves DNS History** – Stores previous DNS states in `fbi_watchdog_results.json`. - ✅ **Cross-Platform** – Works on **Windows, Linux, and macOS**. --- ## ❗ Known Issues / Bugs [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#exclamation-known-issues--bugs) - ❗ **SSL Errors in Screenshots** – Some sites may not load in Selenium due to `ERR_SSL_VERSION_OR_CIPHER_MISMATCH`. - ❗ **DNS Query Failures** – Some domains may not return results due to **NXDOMAIN** errors. - ❗ **Telegram Message Duplication** – On rare occasions, Telegram alerts may be sent twice. --- ## 🚀 Future Features [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#rocket-future-features) - 🚀 **Multi-Platform Notifications** – Add support for **Slack & Email alerts**. - 🚀 **Database Support** – Store DNS history in **SQLite or PostgreSQL** instead of JSON. - 🚀 **Check For Updates** – Script will check for new updates on startup. - 🚀 **Seizure Detection Without NS Changes** – Detect LEA seizures using HTTP status codes, WHOIS changes, and/or SSL certificate logs. - 🚀 **Seizure Detections from Cloudflare NS** \- LEA sometimes use Cloudflare NS when seizing domains. - 🚀 **Custom Domain List and DNS Records File (`config.json`)** – Allow users to define monitored domains, and records into a config file instead of hardcoding. - 🚀 **Randomized User-Agent for Selenium** – Implement a rotating User-Agent to bypass bot detection and avoid fingerprinting. - 🚀 **Onion Site Monitoring** – Add `.onion` support for hidden services. - 🚀 **Faster Checks with AsyncIO or Threading** – Improve DNS monitoring speed by using asyncio (aiodns) or threading for parallel lookups, reducing scan times and improving efficiency. --- ### 💻 System Requirements: [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#-system-requirements) - 🐍 **Python 3.x** (Latest version preferred, minimum recommended: Python 3.8) - 🖥️ **Google Chrome installed** (For Selenium screenshots) ### 📜 Required Python Packages: [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#-required-python-packages) The script requires the following dependencies: dnspython requests python-dotenv selenium webdriver-manager rich --- ## 🖥️ Installation Guide [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#%EF%B8%8F-installation-guide) Follow these steps to install and set up **FBI Watchdog** on your system. --- ### **1️⃣ Clone the Repository** [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#1%EF%B8%8F%E2%83%A3-clone-the-repository)git clone https://github.com/DarkWebInformer/FBI\_Watchdog.git cd FBI\_Watchdog --- ### **2️⃣ Install Dependencies** [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#2%EF%B8%8F%E2%83%A3-install-dependencies) Ensure you have Python **3.x** installed. Then, install the required dependencies: pip install -r requirements.txt --- ### **3️⃣ Setup Environment Variables** [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#3%EF%B8%8F%E2%83%A3-setup-environment-variables) Create a `.env` file in your **root directory** and add your Discord Webhook, Telegram API key, and Telegram Channel ID: WEBHOOK= TELEGRAM\_BOT\_TOKEN= TELEGRAM\_CHAT\_ID= 🔹 Replace ``, ``, and `` with your actual credentials. --- ### **4️⃣ Add Domains to Monitor** [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#4%EF%B8%8F%E2%83%A3-add-domains-to-monitor) Add domains you want to monitor for DNS and seizure changes. domains = \["example.com", "example1.com", "example2.com"\] --- ### **4️⃣ Run the Script** [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#4%EF%B8%8F%E2%83%A3-run-the-script) Start FBI Watchdog with: python fbi\_watchdog.py 🔍 **FBI Watchdog** will now begin monitoring for seizure banners and tracking domain changes. --- ## 💰 Support FBI Watchdog & Dark Web Informer [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#-support-fbi-watchdog--dark-web-informer) FBI Watchdog is an open-source project dedicated to cyber threat intelligence, monitoring seizure banners, and providing real-time insights. Your support helps keep this project running! You can also get access to premium cyber threat intelligence on [**Dark Web Informer**](https://darkwebinformer.com/). ### 📢 Subscription Options: [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#-subscription-options) - 💳 **Standard Subscription:** [Sign up here](https://darkwebinformer.com/#/portal/signup) - 🏴‍☠️ **Crypto Subscription:** [Pay with cryptocurrency](https://darkwebinformer.com/crypto-payments/) 🔍 Stay ahead of the latest cyber threats with real-time intelligence. 🚀 ### ❤️ Donate to Support Dark Web Informer's Work [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#%EF%B8%8F-donate-to-support-dark-web-informers-work) If you find Dark Web Informer and/or FBI Watchdog valuable, consider making a **donation** to help future development, research, and cyber threat intelligence. 👉 [Donate here](https://darkwebinformer.com/donations) ### 📢 Advertise With Dark Web Informer [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#-advertise-with-dark-web-informer) Looking to **promote your cybersecurity services** or **reach the right audience**? Check out the **advertising options** here: [Advertising Rates](https://darkwebinformer.com/advertising-rates) Your support helps keep **FBI Watchdog** and **Dark Web Informer** independent and continuously improving. Thank you! --- [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#star-history) ## 📝 License [](https://github.com/DarkWebInformer/FBI%5FWatchdog/tree/main?tab=readme-ov-file#-license) This project is licensed under the **MIT License** – see the [LICENSE](https://github.com/DarkWebInformer/FBI%5FWatchdog/blob/main/LICENSE) file for details.