Monitoring Certificate Transparency logs for phishing domains

Why certificate logs see phishing early

Certificate Transparency (CT) is a set of public, append-only logs of TLS certificates. Chrome and Safari only trust a certificate if it comes with proof that it was submitted to the logs, so every certificate from a public certificate authority ends up in them, usually within seconds or minutes of being issued.

Phishing pages want a padlock, and free automated certificates make getting one part of setting up the domain. The result is that a new lookalike often appears in a CT log before a single email has been sent. In Greyphish's data, more than half of new combosquats were under a week old when their first certificate was logged, and 42% were under a day old.

Start with your own domain

Before hunting lookalikes, watch for certificates issued for your real domain that nobody on your team asked for. That catches a different problem (a compromised DNS account, a forgotten vendor, a subdomain takeover) and it is free:

• Cloudflare offers Certificate Transparency Monitoring for zones on its platform and emails when a certificate is logged for them.
• Cert Spotter by SSLMate watches named domains and their subdomains.
• crt.sh lets you search by hand: https://crt.sh/?q=yourcompany.com.

All three watch names you own. None of them will tell you about yourcompany-login[.]com, which is the part this guide is about.

Searching CT for lookalikes with crt.sh

crt.sh, run by Sectigo, indexes the major logs and accepts % as a wildcard (%25 in a URL). Searching for your name anywhere in a hostname returns combosquats and TLD swaps:

curl -s "https://crt.sh/?q=%25yourcompany%25&output=json" \
  | jq -r '.[] | [.not_before, .name_value] | @tsv' | sort -u

It also offers a read-only PostgreSQL interface for heavier queries (psql -h crt.sh -p 5432 -U guest certwatch), which is useful for research and easy to overload.

Three limits make crt.sh a research tool rather than an alert system:

• Broad wildcard searches frequently time out, and short brand names match far too much.
• A substring search finds combos but not typos or homoglyphs, because those do not contain your name.
• It is a search, not a feed. Someone has to run it, and there is no alert when a new match appears.

Watching the live stream

For real monitoring you read new certificates as they are logged. The old public certstream service from CaliDog is no longer something to depend on, so self-host instead. certstream-server-go polls the logs directly and serves the same WebSocket format; Greyphish runs it in production, where it delivers around 300 certificates a second.

docker run -d --name certstream -p 8080:8080 0rickyy0/certstream-server-go

A minimal watcher in Python, using the domains-only stream:

import json
import websocket

WATCH = ("yourcompany", "yourcornpany", "yourcompariy")

def on_message(ws, raw):
    msg = json.loads(raw)
    if msg.get("message_type") != "dns_entries":
        return
    for name in msg["data"]:
        if any(w in name for w in WATCH):
            print(name)

websocket.WebSocketApp("ws://localhost:8080/domains-only", on_message=on_message).run_forever()

That works for a demo. To make it useful, generate WATCH from dnstwist's permutations (see how to find lookalike domains), strip the *. from wildcard names, reduce each hostname to its registrable domain with the Public Suffix List, decode xn-- labels, deduplicate (the same certificate is usually logged in two or more logs, once as a precertificate and again as the final certificate), and store what you have already alerted on.

The noise you will get

CT matching produces a lot of hits that are not attacks. The biggest single source we have seen is worth describing in detail, because anyone running a CT watcher in 2026 will have met it.

Between early July and early September 2026, 83,292 of the 102,373 lookalike names Greyphish logged for public brands (81%) ended in .ph, .com.ph, .net.ph or .org.ph. They were long hyphenated combos like facebook-login-checker[.]net[.]ph and facebook-status-alert-0151[.]ph, many in numbered series. The weekly count peaked at 17,047 in the week of 20 July and fell below 200 a week by mid-September.

Counts use whole-word brand matches; an earlier version counted brand names inside other words.

The names were not registered. A made-up name under .ph or .com.ph resolves to the same single address as these lookalikes, and the server at that address presented a valid certificate for one of them. In other words, certificates existed for names nobody owned, most likely issued automatically for a catch-all server whenever someone requested the name over HTTPS. No RDAP record, no zone-file entry, no registrar to report to.

Other routine noise:

• Renewals of old domains. 82% of typosquats were over a year old when first seen in CT; they are renewing, not launching.
• Your own certificates and those of agencies and vendors that host campaigns for you.
• Shared-hosting certificates carrying hundreds of unrelated names, one of which happens to contain your word.
• Dictionary-word brands. If your name is a common word, substring matches are mostly someone else's business.

What CT cannot see

• Domains with no certificate. A lookalike used only for email never needs one. That is the most expensive kind for businesses (see lookalike domains with MX records), and CT will not show it.
• Names hidden behind a wildcard. A certificate for *.example.net covers any subdomain without listing it.
• Plain HTTP sites and certificates from private CAs.

ICANN's Centralized Zone Data Service covers part of the gap. Approved users can download daily zone files for most generic TLDs and diff them to find every new registration, certificate or not. Most country code TLDs do not publish zone files.

How Greyphish does it

Greyphish runs certstream-server-go and an ICANN zone-file pipeline side by side. For each watched domain it precomputes dnstwist permutations, so every new hostname is checked in constant time, and it matches combos with a list of modifiers. Each match is then checked for DNS, MX, a live site, registrar and age, Google Web Risk listing, and later whether it went down. The .ph wave above is part of why that evidence step exists.

The public live feed shows the matching running against 1,250 widely impersonated brands, and the lookalike domain report publishes the aggregates hourly. To watch your own domain, enter it below; one domain is free.

Questions