Skip to content
Get packs

Certificate Transparency Phishing Monitor

Watches public certificate logs for lookalike domains that may be used in phishing

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent can query public Certificate Transparency logs (through crt.sh and the Certstream live feed) to find SSL/TLS certificates issued for domains that imitate your organization or brand. It flags suspicious patterns such as target names inside other domains, brand keywords, and free certificates from Let's Encrypt, and it can write up the findings for a threat intelligence workflow. Certificate Transparency logs are public records of every certificate issued by major certificate authorities, so attackers often reveal phishing sites here before a campaign starts.

Great for

  • Security analysts or SOC teams who want early warning of lookalike phishing domains
  • Brand and domain-protection staff monitoring for unauthorized certificate issuance
  • Developers building a lightweight CT log monitoring script

Skip it if

  • Blocking or taking down sites by itself: the skill only detects and reports candidates, and false positives are likely because name similarity is a heuristic
  • Non-technical users without Python experience, since setup and interpreting results need coding and security knowledge
  • Monitoring at scale without rate-limit planning: it depends on public third-party services (crt.sh, Certstream) that may throttle or change

Try asking

  • “Check crt.sh for certificates issued for *.mycompany.com and list any that contain brand keywords”
  • “Set up a Certstream listener that alerts me when new certificates look similar to our domain”
  • “Run the monitor agent on mycompany.com and summarize suspicious certificates with their crt.sh links”
  • “Explain which certificates for our brand were issued by Let's Encrypt in the last 30 days”
Step-by-step guide: how to use Certificate Transparency Phishing MonitorInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-certificate-transparency-for-phishing.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-certificate-transparency-for-phishing.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-certificate-transparency-for-phishing.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Provide your exact domains and brand keywords so the flags are relevant, and review each hit manually before acting.
  • Check crt.sh's terms and rate limits, and avoid running heavy wildcard queries repeatedly.
  • Read scripts/agent.py before running it, since the skill executes Python and sends queries to external services.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.