Identify Potential Phishing Domains in Near Real Time
Identify potential phishing domains in near real time by monitoring suspicious TLS certificate issuances that are reported to the Certificate Transparency Log (CTL) through the CertStream API. 'Suspicious' issuances refer to those whose domain name scores exceed a specific threshold defined in a configuration file.
Installation Instructions
The script is compatible with both Python2 and Python3. Regardless of the version you choose, make sure to install the required packages after you have cloned or downloaded the source code by running: pip install -r requirements.txt
Configuration: Phishing Catcher utilizes a straightforward YAML configuration file to assign a numeric score to strings that may appear in a TLS certificate's common name or SAN field (i.e., the domain name of a certificate).
Requirements:
Understanding the Configuration File: Suspicious
The configuration file, suspicious.yaml, comes with sensible defaults. However, you have the option to modify or add to both the strings it includes and the scores assigned to each string by editing an override file named external.yaml. Both the default suspicious.yaml and the user-modifiable external.yaml configuration files contain two YAML dictionaries: keywords and tlds.