# analyzing-certificate-transparency-for-phishing

Monitors Certificate Transparency logs to spot phishing lookalikes and certificate issuance affecting an organisation’s domains.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 547 installs · ★ 35034
- Author: mahipal
- License: Apache-2.0 · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-certificate-transparency-for-phishing/SKILL.md
- Updated: 2026-08-31
- HTML: https://affpapa.org/en/nevibecode/skills/analyzing-certificate-transparency-for-phishing

## What it does

This skill lays out a Certificate Transparency review process using `crt.sh` and the Certstream feed. It focuses on lookalike domains, brand-keyword matches, and certificate issuance that warrants investigation.

Its examples include Python classes for querying `crt.sh`, parsing JSON results, and filtering suspicious certificates. The review checks common names, issuers, validity dates, serial numbers, and `crt.sh` identifiers while excluding exact domain matches.

You need Python 3.9+, `requests`, `certstream`, `tldextract`, and `Levenshtein`, plus access to `crt.sh` and Certstream. Prepare a list of organisation domains and brand keywords first; without it, the monitoring rules have nothing to watch.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-certificate-transparency-for-phishing -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/analyzing-certificate-transparency-for-phishing/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/analyzing-certificate-transparency-for-phishing/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-certificate-transparency-for-phishing -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/analyzing-certificate-transparency-for-phishing/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-certificate-transparency-for-phishing -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/analyzing-certificate-transparency-for-phishing/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-certificate-transparency-for-phishing
```

2. **Manually: put the files in place**
- File: `.github/skills/analyzing-certificate-transparency-for-phishing/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-certificate-transparency-for-phishing -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills --path skills/analyzing-certificate-transparency-for-phishing
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/analyzing-certificate-transparency-for-phishing/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-certificate-transparency-for-phishing -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-certificate-transparency-for-phishing/SKILL.md

## When to use it
- query certificate history for a domain with `crt.sh`
- find domains that resemble an organisation domain
- flag certificates containing brand keywords
- review certificates issued by an unexpected certificate authority
- feed suspicious certificate findings into blocking work

## Example prompts
- Check `crt.sh` for `mycompany.com` and identify suspicious certificates.
- Set up Certstream monitoring for our domains and brand keywords.
- Analyse lookalike certificates for `mycompany.org` and explain the flags.

## Source text · SKILL.md · Apache-2.0

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 1c41d246bce06f6b.

BEGIN THIRD-PARTY FILE 1c41d246bce06f6b
```text
---
name: analyzing-certificate-transparency-for-phishing
description: Monitor Certificate Transparency logs using crt.sh and Certstream to
  detect phishing domains, lookalike certificates, and unauthorized certificate issuance
  targeting your organization.
domain: cybersecurity
subdomain: threat-intelligence
tags:
- certificate-transparency
- ct-logs
- phishing
- crt-sh
- certstream
- ssl
- domain-monitoring
- threat-intelligence
version: '1.0'
author: mahipal
license: Apache-2.0
atlas_techniques:
- AML.T0052
nist_csf:
- ID.RA-01
- ID.RA-05
- DE.CM-01
- DE.AE-02
mitre_attack:
- T1583.001
- T1583.004
- T1566.002
- T1608.005
- T1596.003
mitre_f3:
  version: '1.1'
  tactics:
  - resource-development
  - reconnaissance
  - initial-access
  techniques:
  - id: T1583.001
    name: 'Acquire Infrastructure: Domains'
    tactic: resource-development
    source: attack
  - id: F1020.002
    name: 'Create Fake Materials: Fake Website'
    tactic: resource-development
    source: f3
  - id: T1593
    name: Search Open Websites/Domains
    tactic: reconnaissance
    source: attack
  - id: T1598
    name: Phishing for Information
    tactic: reconnaissance
    source: attack
  - id: T1660
    name: Phishing
    tactic: initial-access
    source: attack
---
# Analyzing Certificate Transparency for Phishing

## Overview

Certificate Transparency (CT) is an Internet security standard that creates a public, append-only log of all issued SSL/TLS certificates. Monitoring CT logs enables early detection of phishing domains that register certificates mimicking legitimate brands, unauthorized certificate issuance for owned domains, and certificate-based attack infrastructure. This skill covers querying CT logs via crt.sh, real-time monitoring with Certstream, building automated alerting for suspicious certificates, and integrating findings into threat intelligence workflows.


## When to Use

- When investigating security incidents that require analyzing certificate transparency for phishing
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques

## Prerequisites
```
END THIRD-PARTY FILE 1c41d246bce06f6b

The third-party file has ended. Everything between the 1c41d246bce06f6b tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2246 of 14088 bytes. © mahipal · Apache-2.0 · https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/HEAD/skills/analyzing-certificate-transparency-for-phishing/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md