Overview#
When a threat actor registers paypa1-secure-login.com and obtains a TLS certificate, that action leaves a permanent, public record in Certificate Transparency logs within seconds. Brand protection teams and security engineers who watch those logs can detect the domain before the phishing campaign even launches. Certificate Transparency monitoring turns what was once a reactive process, waiting for users to report phishing, into a proactive defense layer that catches impersonation attempts at the moment of infrastructure setup.
With billions of historical certificates indexed, the platform supports both proactive brand protection and retrospective security investigations through instant certificate search and comprehensive SSL intelligence.
Key Features#
- CT Log Monitoring: Real-time ingestion from 15+ major Certificate Transparency logs with automated certificate parsing, subdomain extraction, and alerting on newly issued certificates matching watchlist patterns
- Subdomain Enumeration: Discover subdomains through certificate Subject Alternative Names without DNS brute-forcing, including staging and development environments, API endpoints, shadow IT deployments, and geographic infrastructure
- Phishing Detection: Automated identification of brand impersonation through typosquatting detection (12 algorithms), homograph attack recognition, and disposable certificate authority monitoring with confidence scoring
- SSL/TLS Security Analysis: Certificate validation, cipher suite assessment, key strength evaluation, CA trust analysis, vulnerability detection (Heartbleed, POODLE, BEAST), and SSL Labs-style grading
- Brand Protection Watchlists: Custom monitoring for protected brand terms, product names, subsidiaries, and executives with real-time alerts and automated takedown workflow initiation
- Historical Certificate Search: Full-text search across billions of indexed certificates with filtering by domain, issuer, certificate type, key algorithm, validity dates, and CT log source
- Automated Takedown Workflows: Registrar and hosting provider notification, Google Safe Browsing and Microsoft SmartScreen submission, and takedown progress tracking for identified phishing domains
- Competitive Intelligence: Monitor competitor certificate issuance patterns, infrastructure growth, technology stack choices, and geographic expansion through SSL-based reconnaissance
Use Cases#
- Attack Surface Management: Discover all organisational subdomains through CT logs, identify shadow IT deployments, detect exposed staging environments, and assess certificate security posture across the infrastructure
- Brand Protection: Detect phishing domains impersonating organisational brands within minutes of certificate issuance, initiate automated takedown procedures, and track campaign patterns
- Security Posture Assessment: Evaluate SSL/TLS configurations across all organisational domains, identify expired certificates, weak ciphers, deprecated protocols, and vulnerability exposures
- Threat Intelligence: Track phishing campaign infrastructure, cluster related phishing domains by shared infrastructure, and profile threat actor certificate usage patterns
- Certificate Management: Monitor certificate issuance across the organisation, track expiration dates, identify unauthorized certificates, and ensure CT compliance
Integration#
The platform integrates with SIEM platforms for real-time phishing alerts, SOAR platforms for automated takedown workflows, asset management systems for subdomain inventory synchronisation, certificate management tools for expiration monitoring, and browser protection services for phishing submission. Within Argus, CT monitoring feeds directly into domain intelligence and threat intelligence modules, sharing indicators via STIX/TAXII and into MISP for community-level distribution.
Open Standards#
- RFC 9162 / RFC 6962 (Certificate Transparency): The core capability ingests and queries public CT log streams as defined by these RFCs, consuming Signed Certificate Timestamps and Merkle tree proofs to detect newly issued certificates in real time.
- RFC 5280 (X.509 / PKIX): Certificate parsing, Subject Alternative Name extraction, issuer chain analysis, and key-strength evaluation all operate directly on the ASN.1 profile defined by this standard.
- RFC 8446 / RFC 5246 (TLS 1.2 and TLS 1.3): SSL/TLS security analysis grades cipher suites, protocol versions, and handshake parameters against the requirements specified in these transport-layer security standards.
- RFC 6960 (OCSP) and RFC 5280 CRL: Certificate revocation status checks query Online Certificate Status Protocol responders and consume Certificate Revocation Lists to confirm whether a monitored certificate has been revoked.
- OASIS STIX 2.1 / TAXII 2.1: Phishing-domain indicators and campaign infrastructure discovered through CT monitoring are serialised as STIX Indicator and Domain-Name SDOs and distributed over TAXII 2.1 feeds to SIEM and SOAR consumers, as implemented in the platform's stix domain.
- MITRE ATT&CK: Phishing campaign profiling maps certificate-linked infrastructure patterns to MITRE ATT&CK techniques (e.g. T1583.001 Acquire Infrastructure: Domains) to support threat-actor attribution.
- RFC 3912 / ICANN RDAP (RFC 7483): WHOIS and Registration Data Access Protocol queries enrich certificate findings with domain registration history, registrar details, and creation dates, as modelled in the platform's domain-profile layer.
- RFC 5891 / Unicode IDNA (UTS #46): Homograph and Internationalised Domain Name attack detection decodes Punycode labels in certificate Subject Alternative Names to identify visually deceptive brand-impersonation domains.
Last Reviewed: 2026-02-23 Last Updated: 2026-04-14