Certificate Transparency
Certificate Transparency (CT) is the public, append-only logging of every TLS certificate a trusted authority issues, which lets defenders spot new phishing domains the moment they get a certificate.
How it works
Browsers require certificates to be logged, so a new phishing site appears in CT logs minutes after it obtains HTTPS, often before any page is live.
Monitoring CT for brand names and look-alike patterns is one of the earliest detection signals PhishDestroy uses.
Example from the PhishDestroy database
- bridge-pulsepinata.com: Domain report with stored certificate data, first detected 2026-10-22.
- xamvault.info: Domain report with stored certificate data, first detected 2026-10-22.
- gerwaldkronberg.com: Domain report with stored certificate data, first detected 2026-10-22.
How to protect yourself
- Brand owners can monitor CT logs for certificates containing their names.
- Investigators can search CT (for example crt.sh) to find sibling domains on the same certificate.