How do you monitor certificate transparency for your brand?

What is Certificate Transparency, and why does it help a crypto project?

Certificate Transparency is a system of public logs in which certificate authorities record the certificates they issue. Because the logs are public, anyone can search them for a name, including a name that imitates yours. A phisher who wants HTTPS on a look-alike domain usually requests a certificate, and that request becomes a visible entry.

This matters for two situations. The first is the look-alike domain: an attacker registers a name that resembles yours, obtains a certificate and starts a campaign. The second is the hijack: Blockaid reported that in the February 2026 front-end compromises the attacker's SSL certificates were issued the same day as the DNS change, and that wildcard certificates were issued for the Nerochain domain. A log entry for your own domain that you did not request is an early warning.

A citable definition: Certificate Transparency monitoring is the practice of searching public certificate logs for names that contain your brand, so that look-alike and hijack certificates are seen when they are issued, not when users are hurt.

How do you search crt.sh for your brand?

Search crt.sh by identity, using your domain name and your brand string, and review the list weekly. crt.sh is a certificate search service operated by Sectigo. It accepts a domain name or organisation name as an identity, a certificate fingerprint or a crt.sh ID.

Its Advanced page lists the match operators Autoselect, equals, ILIKE and LIKE, a scope choice, a checkbox to exclude expired certificates and one to deduplicate certificate and precertificate pairs. The LIKE operators are SQL operators, in which the percent sign matches any text, so a pattern such as the brand with a percent sign on each side lists names that contain it. crt.sh's page does not document the pattern characters, so confirm the behaviour with a test search on a name you own.

Record what you find. Keep a short list of your own legitimate names and issuers, and review every other entry. For each look-alike name, take the next steps from how to find look-alike domains of your brand.

How do you stream new certificates with CertStream?

CertStream delivers new Certificate Transparency entries in real time, and a short script flags the ones that match your brand. It is fast but noisy, because most certificates are unrelated, so the matching rule decides how useful it is.

The Python library installs with pip. Its README registers a callback that receives a message and a context, checks that the message type is certificate_update and reads the list of domains from the leaf certificate. The sample below follows that structure and adds a brand match.

# pip install certstream
import certstream

BRAND = 'examplecoin'

def on_cert(message, context):
    if message['message_type'] == 'certificate_update':
        for name in message['data']['leaf_cert']['all_domains']:
            if BRAND in name.lower():
                print(name)

certstream.listen_for_events(on_cert, url='wss://certstream.calidog.io/')

Which strings and endings should you watch?

Watch your exact brand, its common misspellings and the brand combined with words like login, claim, airdrop or wallet. Use dnstwist, an open-source permutation engine, to generate typo, homoglyph, hyphenation and extension-swap variants of your name, and feed those strings to your matcher.

Weight the endings by abuse data. According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's data for 1 May 2025 to 30 April 2026 are sold by Wardmint: .com (869,180 domains), .pro (130,945), .info (99,602), .xyz (93,987), .shop (79,625) and .icu (74,786). The other four are .top, .cn, .vip and .cc. Wardmint does not sell .top. Owning the endings you sell ahead of time removes the matches an attacker could otherwise take.

Count is not risk. Interisle's phishing score, per 10,000 delegated domains, puts .icu at 1,607 and .pro at 1,200.1 against 53.7 for .com, so a hit on a small, abused ending deserves a faster look than one on .com. The list and scores are in which domain extensions are most used for phishing.

What do you do when a suspicious certificate appears?

Check the name, record the evidence and act in the order that fits the case. For a look-alike name, load it safely, take screenshots, save the certificate entry and the page, and run the report steps. For an unexpected certificate on your own domain, verify your DNS records and registrar account first, because it may mean someone changed where your domain points.

The response plan is in what to do when a phishing site impersonates your project. A CAA record limits which authorities can issue for your own names, as described in how to set up CAA records. Wardmint registers domains and DNS records; it does not run monitoring or takedown services, which is why this guide uses free tools.