Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Failed to load latest commit information.

Phishing Catcher

Catch possible phishing domains in near real time by looking for suspicious TLS certificate issuances reported to the Certificate Transparency Log (CTL) via the CertStream API. "Suspicious" issuances are those whose domain name scores beyond a certain threshold based on a configuration file.

This is just a working PoC. Feel free to contribute and tweak the code to fit your needs. 👍

Screencast of example usage.


The script should work fine using Python2 or Python3. In either case, install the requirements after cloning or downloading the source code:

pip install -r requirements.txt


Phishing Catcher uses a simple YAML configuration file to assign a numeric score for strings that can be found in a TLS certificate's common name or SAN field (i.e., a cert's domain name). The configuration file, suspicious.yaml, ships with sensible defaults, but you can adjust or add to both the strings it contains and the score assigned to each string by editing an override file, external.yaml.

Both the default suspicious.yaml and the user-modifiable external.yaml configuration files contain two YAML dictionaries: keywords and tlds. The keys of the dictionaries are the strings and the values are the scores to assign if that string is found in the domain name for an issued certificate. For example:

    'login': 25

Here, a score of 25 is added to the generic keyword login when it is found in a TLS certificate domain name. Increasing this value will raise the level of suspicion against domains with the string login in them, thus allowing you to subject these certificate issuances to increased scrutiny.

However, in order to be reported as suspicious by Phishing Catcher, the score assigned to a given certificate must meet or exceed (>=, "greater than or equal to") the following thresholds:

Score Reported as
65 Potential
80 Likely
90 Suspicious

💡 See the score_domain() function in the source code for details regarding the scoring algorithm.


Once configured to your liking, usage is as simple as running the script:

$ ./

Example phishing caught

Paypal Phishing

Phishing catcher in Docker container

If you running MacOs or having a different OS version that would make the installation of phishing_catcher difficult, then having the tool dockerized is one of your options.

docker build . -t phishing_catcher




If this tool has been useful for you, feel free to thank me by buying me a coffee.