# Certificate Transparency

Certificate Transparency (CT) is the public, append-only logging of every TLS certificate a trusted authority issues, which lets defenders spot new phishing domains the moment they get a certificate.

## How it works

Browsers require certificates to be logged, so a new phishing site appears in CT logs minutes after it obtains HTTPS, often before any page is live.

Monitoring CT for brand names and look-alike patterns is one of the earliest detection signals PhishDestroy uses.

## Example from the PhishDestroy database

- [bridge-pulsepinata.com](https://phishdestroy.io/domain/bridge-pulsepinata.com/): Domain report with stored certificate data, first detected 2026-10-22.
- [xamvault.info](https://phishdestroy.io/domain/xamvault.info/): Domain report with stored certificate data, first detected 2026-10-22.
- [gerwaldkronberg.com](https://phishdestroy.io/domain/gerwaldkronberg.com/): Domain report with stored certificate data, first detected 2026-10-22.

## How to protect yourself

- Brand owners can monitor CT logs for certificates containing their names.
- Investigators can search CT (for example crt.sh) to find sibling domains on the same certificate.

## Related tools

- [X.509 Certificate Decoder](https://phishdestroy.io/developer-tools/x509-decoder)
- [Reputation Links](https://phishdestroy.io/developer-tools/reputation-links)

## Related terms

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [Favicon hash](https://phishdestroy.io/glossary/favicon-hash/)

## Further reading

- [Newly Registered Domains: Phishing Risk Guide](https://phishdestroy.io/newly-registered-phishing-domains)
- [Why Phishing Scanners Disagree: A Field Guide](https://phishdestroy.io/why-phishing-scanners-disagree)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/certificate-transparency/