Lion Cipher Lab
Hunt lookalike domains in Certificate Transparency logs before the phishing email lands
- Threat Intel Analyst
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Here is a fact about the internet that most working defenders have never been told plainly: every publicly trusted TLS certificate issued anywhere in the world is published, within seconds, to public append-only logs that anyone on earth can read for free. Not a sample. Not the ones a vendor chose to index. All of them. That is not a leak — it is a deliberate design decision the browser makers forced on the certificate industry after a series of mis-issuance scandals, and the side effect is one of the highest-signal early-warning feeds in security. When an attacker registers…
What you'll learn
- what Certificate Transparency is, the CA mis-issuance problem it was built to solve, and why browsers now refuse certificates that were not logged
- reading a CT log entry: issuer, common name, the SAN list, not-before and not-after
- the precertificate-versus-leaf duplicate that confuses everyone on their first search
- querying CT from a browser and from the command line, with jq taught from zero
- using CT as an inventory of your OWN attack surface, including the forgotten staging host
- generating the lookalike permutation space with dnstwist: typo, homoglyph, bitsquat, hyphenation, TLD-swap and combosquat
- recognising an IDN homograph attack and reading a punycode (xn--) domain
- narrowing a permutation list to the variants that are actually registered and actually mail-capable
- triaging candidates into hostile / defensive / parked / unrelated with a written verdict per domain
- the safety rules for looking at a suspected phishing site without becoming a victim of it
Steps in this lab
- The problem that created Certificate Transparency — and the words you need
- Set up your toolkit: curl and jq
- Your first CT search in the browser — and the duplicate that confuses everyone
- From the command line: JSON, jq, and a search API that stays up
- The move most people miss: CT is an inventory of YOUR attack surface
- Install dnstwist
- Generate the permutation space — and meet the homoglyph
- Narrow it: which permutations actually EXIST, and which can take mail
- STOP — the rules of engagement, before you open anything
- Triage: turn candidates into a written verdict each
- Make it a monitor, not a one-off
- Turn it into action: watchlist, blocklist, takedown, retro-hunt, UDRP
- The judgement: when CT monitoring is the right tool, and when it is not