Certificate Transparency Logs: An Underused OSINT Goldmine
Discover how to use Certificate Transparency (CT) logs to uncover hidden subdomains, track infrastructure, and expose malicious network setups.
In an effort to secure the web, tech giants created a system that accidentally became one of the most powerful tools for OSINT investigators. Certificate Transparency (CT) is a framework where every publicly trusted SSL/TLS certificate is recorded in an open, append-only cryptographic log. For investigators, this means a public record of almost every website created.
Why CT Logs Matter
When a developer or threat actor creates a secure website (using HTTPS), they must request a certificate from a Certificate Authority (CA) like Let's Encrypt or DigiCert. The CA issues the certificate and simultaneously publishes the details to a CT log. This happens before the site is even launched or indexed by Google.
Subdomain Enumeration
The most common use of CT logs is finding hidden subdomains. Companies frequently create subdomains for testing, internal portals, or staging environments (e.g., dev.target.com, admin-portal.target.com).
Because they want these connections secured, they request a certificate. By searching a database like crt.sh for %target.com, an investigator can retrieve a complete list of every subdomain that has ever had a certificate issued, often bypassing the need for aggressive DNS brute-forcing.
Tracking Phishing and Fraud Campaigns
Threat actors heavily rely on Let's Encrypt because it is free and automated. When they spin up hundreds of look-alike domains for a phishing campaign (e.g., paypal-secure-login-update.com), they register certificates for all of them.
By monitoring CT log streams in real-time for specific keywords (like "paypal", "login", or a targeted company's name), security teams can detect and block malicious infrastructure the moment it is provisioned, before a single phishing email is sent.
Subject Alternative Names (SAN)
A single SSL certificate can cover multiple different domains using the Subject Alternative Name (SAN) field. A lazy scammer might host three different fake crypto exchanges on the same server and secure them all with one certificate.
Checking the SAN fields of a certificate on one scam site often hands you the domains of three other undiscovered scams operated by the same group.
Historical Infrastructure Analysis
CT logs are permanent. Even if a site is taken down and the domain expires, the record of its certificate remains. This allows investigators to look back in time and prove that a specific domain was active and secured during a particular timeframe, which is invaluable for historical fraud investigations.
Automated CT Log Integration
Aletheia continuously queries Certificate Transparency logs in the background, instantly mapping related subdomains and exposing multi-domain infrastructure used by threat actors.