Investigator Use
urlwatch is an open-source command-line tool for monitoring web pages and notifying users when their content changes. Unlike browser-based monitoring services, urlwatch runs locally or on a server, giving investigators and security professionals complete control over monitoring logic, notification methods, and data handling — with no third-party service having access to monitored URLs or results.
The tool is written in Python and supports flexible configuration for monitoring any number of URLs at user-defined intervals. Each monitored URL can have custom filters applied — stripping HTML tags to monitor only text content, applying regular expressions to focus on specific content sections, or diffing only specific JSON fields in API responses. This granular filtering prevents alert fatigue from irrelevant changes (like ad content or timestamps) while ensuring meaningful content changes trigger notifications.
Notification channels supported by urlwatch include email, Slack, Telegram, XMPP, and many others through plugin extensions. For security teams maintaining operational security (OPSEC), running urlwatch on an isolated server with custom notification routing is preferable to using commercial monitoring services that might log monitored URLs.
For OSINT investigators, urlwatch enables monitoring of dark web pages (via Tor proxy integration), private network resources accessible from a monitoring server, and sites that block known monitoring service IP ranges. Running urlwatch from a customized server allows monitoring targets that block commercial services.
Advanced users can write custom Python scripts triggered by changes — enabling automated responses like capturing a full page archive, running a downstream analysis script, or updating an investigation database when a monitored page changes. This programmability makes urlwatch a foundational building block for automated web intelligence workflows.
Installation via pip: run "pip install urlwatch". Configuration uses YAML files for URL definitions and notification settings. Full documentation is available on GitHub.
Limitations include the technical barrier: urlwatch requires command-line comfort and server management skills. For non-technical investigators, commercial services like Change Detection or Follow That Page provide equivalent functionality without setup complexity.
Use urlwatch in a dedicated monitoring environment and document all monitored URLs with investigation context for audit purposes.
Before You Pivot
Record Context
Capture the target, search terms, and why this source is relevant before you leave the page.
Preserve Evidence
Archive volatile pages, save screenshots, and keep timestamps for anything that may change.
Corroborate
Treat one tool as a lead source. Confirm important findings with independent sources.
Related Tools
Change Detection
Archive & Capture
Monitor any website for changes with Visualping. Get instant alerts via email, SMS, API or Slack when a web page changes. Try it free today!
Follow that page
Archive & Capture
Follow That Page monitors web pages for content changes and sends alerts to support ongoing surveillance of investigation targets.
Image Wayback
Archive & Capture
ArcGIS Image Wayback archives satellite imagery over time, enabling investigators to compare historical and current aerial views of any location.
Screen Capture
Archive & Capture
ShareX is a free screen capture tool with scrolling capture, annotation, and OCR for documenting OSINT investigation findings.
SingleFile
Archive & Capture
Web Extension for saving a faithful copy of a complete web page in a single HTML file
Web Copy
Archive & Capture
Cyotek WebCopy downloads entire websites to local storage for offline review and evidence preservation in OSINT investigations.