TLS Certificate Transparency Log Analysis
Searches public certificate logs to spot phishing and lookalike domains
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
This skill teaches an AI agent to search public Certificate Transparency logs (through the crt.sh service) for TLS certificates issued to domains. Certificate Transparency is a public record of every certificate authorities issue, so the agent can look for lookalike domains that attackers register for phishing, certificates issued unexpectedly for your organization, or unknown subdomains. It also describes measuring how close domain names are to your brand using Levenshtein distance, a standard string-similarity measure.
Great for
- Security operations analysts monitoring for brand impersonation and phishing domains
- Security engineers building proactive certificate monitoring or threat hunting workflows
- Teams checking for shadow IT or unauthorized certificate issuance across their domains
Skip it if
- Users who need guaranteed, complete phishing detection: the skill depends on a third-party service and on the agent's judgment, so it can miss or misclassify domains
- Anyone querying domains they do not own or have authorization to investigate, since results can expose third-party infrastructure and the skill's own docs require authorization
- Production monitoring without review: the bundled script is a partial example and the SKILL.md notes its prerequisites should be validated in a lab first
Try asking
- “Search certificate transparency logs for certificates issued to example.com and list any unexpected issuers”
- “Find lookalike domains of my brand that were issued certificates in the last 30 days, ranked by Levenshtein distance”
- “Check whether any certificates have been issued for subdomains of my company that we do not recognise”
- “Summarise suspicious certificates for a phishing investigation report”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-tls-certificate-transparency-logs.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-tls-certificate-transparency-logs.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-tls-certificate-transparency-logs.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Only run queries against domains you own or are authorised to investigate, and review results before acting on them
- Install and test pycrtsh and the script in a lab first, since the documented API calls and the bundled script may need adjusting for your environment
- Treat matches as leads to verify (WHOIS, DNS, certificate details) rather than confirmed phishing
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.