Know within minutes if your dApp's domain or frontend gets hijacked
Front Sentinel watches your registrar, nameservers, certificates and the JavaScript your users actually load, and alerts your team the moment something changes.
Free, no sign-up. Checks registrar locks, DNSSEC, CAA, expiry, nameserver consistency, SRI and CSP. Takes about 10 seconds.
Why this matters
Attackers don't need to break your contracts. They take over the domain at the registrar, point it to their own server, issue a fresh certificate and serve a wallet drainer under your name. Users sign because the URL is right.
- July 2024: Compound, Celer, Pendle and others hit in a wave of DNS hijacks after the Squarespace migration. Celer caught it in progress.
- May 2025: Curve's nameservers changed at the registrar; the team needed time to notice and regain control.
- November 2025: Aerodrome and Velodrome frontends hijacked through their registrar, the second time in two years.
In every case the first signals were public: a registry status change, new nameservers, a certificate in Certificate Transparency logs. Whoever sees them first wins the race.
What we watch
Registrar and registry
Transfer/update locks removed, registrar changed, pending transfer, delegation changed at the registry, expiry.DNS from three resolvers
NS, A/AAAA, CAA, MX and DS records compared across Cloudflare, Google and Quad9, so partial changes show up too.Certificate Transparency
Every new certificate for your domain and subdomains, flagged when it comes from a CA you've never used.Frontend integrity
Hashes of every script your page loads. Alerts on new script hosts and on third-party files that change at the same URL, the Ledger connect-kit pattern.Signals are correlated: a new certificate plus a nameserver or registrar change becomes one critical possible hijack alert instead of noise.
Alerts where your team already is
Telegram, email, Discord or Slack webhook. Monitoring plans are opening soon. Run a free scan to see where your domain stands today.