Short answer
Certificate Transparency (CT) is a set of public, append-only logs of every publicly trusted TLS certificate. Chrome has required CT for certificates issued after April 30, 2018, so a new phishing domain shows up in the logs as soon as it gets a certificate, often before it goes live. Monitors read the logs and flag names that look like yours.
Who this is for: Crypto teams and security staff who want early warning of new fake sites.
How it works
- A website owner asks a certificate authority for an HTTPS certificate.
- The authority submits the certificate to several public CT logs. Each log returns a signed promise to include it.
- The browser checks those promises when the site loads. Without them, Chrome does not trust the certificate.
- Anyone can read the logs. Monitors watch them for "suspicious certificates", in the words of certificate.transparency.dev.
Key facts
| Fact | Detail |
|---|---|
| Standard | RFC 6962 (2013, experimental), replaced by RFC 9162, CT version 2.0 (2021) |
| Browser requirement | Chrome requires CT for publicly trusted certificates issued after April 30, 2018 |
| Logs per certificate | Chrome asks for proof from 2 logs for certificates valid up to 180 days, 3 for longer ones |
| Scale | More than 2.56 billion certificates logged since 2013 |
| Free search | Sectigo's crt.sh; the open-source certstream streams new certificates live |
Why it matters for phishing
Wallets and browsers warn about plain HTTP, so almost every phishing site uses HTTPS. Free certificate authorities issue a certificate within minutes of a domain going live, and that certificate is logged at once. Because the name is in the log before the scammer shares the link, CT is one of the earliest public signals that a lookalike domain exists. ChainPatrol, for example, lists certstream among its real-time feeds.
A CT monitor for brand protection compares each new certificate's names with your brand: exact words, typos and homoglyphs. A match is a lead, not proof: the next step is to open the page and see what it shows.
What it does not catch
- Platform subdomains. A page on
something.vercel.appuses the platform's wildcard certificate, so its name never appears. - Wildcard certificates on a scammer's own domain. A certificate for
*.fake-domain.examplehides which subdomains are used. - Plain HTTP and IP addresses. No certificate, no log entry.
That is why CT monitoring is combined with newly registered domain lists and checks of hosting platforms.
Sources
- RFC 9162: Certificate Transparency 2.0
- Chrome: Certificate Transparency
- Chrome CT policy
- certificate.transparency.dev
- certstream-server
Frequently asked questions
Does every phishing site appear in CT logs?
Every site with a publicly trusted certificate does. A site on a platform subdomain uses the platform's wildcard certificate, so its own name does not appear, and plain HTTP sites have no certificate at all.
Can I search the logs myself?
Yes. Free search tools such as Sectigo's crt.sh list certificates for a name, and certstream streams new certificates as they are logged.