Мониторинг Certificate Transparency для защиты от фишинга

★ 8.4 · security

analyzing-certificate-transparency-for-phishing is a Claude Code skill that monitors Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized SSL/TLS certificate issuance targeting your organization. The skill covers querying crt.sh via its JSON API and PostgreSQL database with wildcard searches, real-time stream monitoring through Certstream, building automated alerts for suspicious certificates, and integrating findings into threat intelligence workflows. It requires Python 3.9+ with the requests, certstream, tldextract, and Levenshtein libraries, plus a list of organization domains and brand keywords to watch. Designed for SOC analysts and threat hunters, it exploits a key window: attacker certificates appear in CT logs before a phishing campaign launches, enabling proactive blocking of lookalike domains registered through free CAs like Let's Encrypt.