A Python tool that catches potential phishing domains in near real-time by analyzing suspicious TLS certificate issuances via CertStream.
Phishing Catcher is a Python tool that monitors the Certificate Transparency Log via the CertStream API to detect potential phishing domains in near real-time. It analyzes TLS certificate issuances, scores domain names based on suspicious keywords and TLDs, and alerts users when scores exceed configurable thresholds. The tool helps identify malicious domains that mimic legitimate services to steal credentials or data.
Security analysts, threat hunters, and cybersecurity professionals who need to monitor for phishing campaigns and suspicious domain registrations. It's also suitable for organizations looking to enhance their threat intelligence capabilities with automated detection.
Developers choose Phishing Catcher for its real-time monitoring of certificate transparency logs, customizable scoring system, and ease of deployment via Docker. It provides an open-source, configurable alternative to commercial threat intelligence platforms for phishing domain detection.
Phishing catcher using Certstream
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Continuously analyzes TLS certificate issuances via the CertStream API, enabling near-instant detection of new phishing domains as they are registered.
Uses YAML configuration files (suspicious.yaml and external.yaml) to adjust keyword and TLD scores, allowing users to tailor detection logic to evolving threats.
Supports containerization with Docker, simplifying setup across different operating systems, as highlighted in the README for easier cross-platform use.
Marked as a proof-of-concept, it offers full source code access for modifications and contributions, empowering users to adapt it to specific needs.
Relies on static keyword and TLD scoring, which may miss sophisticated phishing domains that avoid obvious patterns or use new TLDs not in the config.
Outputs primarily to console, requiring additional scripting to integrate with external alerting systems like Slack or databases for automated workflows.
The scoring system can flag benign domains with common keywords, necessitating manual review and fine-tuning of thresholds to reduce noise.
The README provides basic setup but lacks detailed guidance on performance tuning, handling high-volume streams, or advanced configuration scenarios.