Certificate Transparency Log Firehose

Stream newly-issued certificates from the public Certificate Transparency log ecosystem — Google, Cloudflare, DigiCert, Sectigo, and TrustAsia's currently-usable RFC6962 logs — matched against your own watch-list of domains, brand names, or keywords. Every run picks up exactly where the last one left off (a saved cursor per log), so scheduled runs only cost you for genuinely new certificates, not the same firehose over and over.

This is not a one-domain crt.sh lookup. It reads the logs themselves and emits only the certificates that match what you're watching for — the phishing-cert / typosquat / newly-observed-subdomain surface that a single-domain tool can't see.

---

Certificate Transparency Log Firehose Features

• Delta-since-last-run — a per-log cursor (Merkle tree index) is saved automatically between runs, so a scheduled job only pays for certificates issued since the last check
• Multi-log fan-out — scans every currently-usable log across Google, Cloudflare, DigiCert, Sectigo, and TrustAsia in one run (or restrict to specific operators)
• Watch-list matching — substring or regex match against each certificate's Common Name and every Subject Alternative Name; only matches are returned (and billed) — everything else is scanned-and-discarded
• Precertificate + final-cert coverage — both CT log entry types are parsed, so you see a domain the moment its precert is logged, not just the final issued cert
• Optional typosquat detection — supply a defended brand list and get a typosquat_flag on certs whose SAN/CN fuzzy-matches (near-miss or contains) one of your brands
• Passive, read-only — reads public, append-only RFC6962 log endpoints only. No scanning, probing, or contact with any certificate subject or domain owner
• No proxy, no auth needed — CT logs are public infrastructure; this actor is cheap to run

---

What Can You Do With CT Log Data?

• Security / brand-protection teams — catch phishing certs and typosquat domains the moment they're issued, before a campaign goes live
• Attack-surface management (ASM) — discover newly-registered subdomains for your own apex domains as soon as a cert is issued, before the site is public
• Threat intel researchers — build a continuous feed of certs matching infrastructure keywords (hosting providers, C2 naming patterns, campaign-specific strings)
• M&A / due-diligence teams — track a target company's certificate issuance as a signal of new product launches or infrastructure changes

---

How Certificate Transparency Log Firehose Works

1. Provide a watchList of domains, brand names, or keywords to match.
2. The actor fetches the Google-maintained list of all CT logs, filters to currently-usable logs (optionally restricted to specific operators), and reads each log's current size (get-sth).
3. For each log, it fetches new entries since the last saved cursor (get-entries), parses each certificate (both final certs and precertificates), and tests the Common Name + all Subject Alternative Names against your watch-list.
4. Only matching certificates are saved to the dataset. The cursor advances past every entry scanned — matched or not — so nothing is ever re-scanned or re-billed.

---

Input

{
  "watchList": ["yourbrand", "your-apex-domain.com"],
  "matchMode": "substring",
  "typosquatBrands": ["yourbrand"],
  "logOperators": [],
  "maxEntriesPerLogPerRun": 5000,
  "bootstrapLookback": 2000,
  "maxItems": 25
}

Field	Type	Required	Default	Description
watchList	array	Yes	—	Domains, brand names, or keywords to match against each cert's CN + SANs. A cert is only returned (and billed) if it matches.
matchMode	string	No	"substring"	"substring" = case-insensitive contains match. "regex" = each watch-list entry is a case-insensitive regular expression.
typosquatBrands	array	No	[]	Defended brand names to fuzzy-match (edit distance ≤2, or substring) against each SAN's registrable-domain label. Sets typosquat_flag on matches. Leave empty to skip.
logOperators	array	No	[] (all)	Restrict the scan to specific CT log operators (Google, Cloudflare, DigiCert, Sectigo, Let's Encrypt, TrustAsia, Geomys, IPng Networks). Empty = every currently-usable log.
maxEntriesPerLogPerRun	integer	No	5000	Safety cap on how many leaf entries are scanned per log per run, independent of maxItems.
bootstrapLookback	integer	No	2000	For a log with no saved cursor yet, how many entries back from the current tree tip to start. CT logs hold billions of entries — a from-genesis backfill is never useful.
maxItems	integer	No	25	Maximum number of matched (and billed) certificate records this run.

---

Certificate Transparency Log Firehose Output Fields

{
  "log_url": "https://ct.googleapis.com/logs/us1/argon2026h2/",
  "leaf_index": 1964624416,
  "cert_sha256": "ca6c8cb3ca89bedcba576819d3ed405633e8f00a7a7ed4587cfdc975b714137b",
  "serial_number": "055DFD94E7DA6B695FB9401E45CAAFF34069",
  "common_name": "yourbrand-secure-login.com",
  "subject_alt_names": ["yourbrand-secure-login.com"],
  "matched_pattern": "yourbrand",
  "issuer_cn": "R11",
  "issuer_org": "Let's Encrypt",
  "not_before": "2026-07-13T05:34:43.000Z",
  "not_after": "2026-10-11T05:34:42.000Z",
  "is_precert": false,
  "is_wildcard": false,
  "entry_timestamp": "2026-07-13T06:33:14.185Z",
  "first_seen_at": "2026-07-13T06:35:00.911Z",
  "typosquat_flag": true,
  "scraped_at": "2026-07-13T06:35:00.911Z"
}

Field	Type	Description
log_url	string	Base URL of the CT log this certificate was read from
leaf_index	integer	Index of this entry in the log's Merkle tree
cert_sha256	string	SHA-256 fingerprint of the certificate DER
serial_number	string	Certificate serial number
common_name	string	Subject Common Name (CN), if present
subject_alt_names	array	All dNSName Subject Alternative Names — the newly-observed-subdomain surface
matched_pattern	string	Which watch-list term/pattern matched
issuer_cn	string	Issuing CA's Common Name
issuer_org	string	Issuing CA's Organization
not_before	string	Certificate validity start (ISO 8601)
not_after	string	Certificate validity end (ISO 8601)
is_precert	boolean	true if this is a precertificate (logged before the final cert was issued)
is_wildcard	boolean	true if the CN or any SAN is a wildcard (*.example.com)
entry_timestamp	string	The CT log's own timestamp for this entry (ISO 8601) — when the log accepted it
first_seen_at	string	When this actor first observed the entry (ISO 8601) — the delta anchor
typosquat_flag	boolean	true if a SAN/CN fuzzy-matched your typosquatBrands list
scraped_at	string	When this record was scraped (ISO 8601)

---

FAQ

How do I monitor Certificate Transparency logs for my brand?

Set watchList to your brand name(s) and apex domain(s), and optionally typosquatBrands to the same brand names for fuzzy phishing-cert detection. Schedule the actor to run on a recurring basis (hourly or daily) — each run only returns certificates issued since the last run, so you're notified of new matches as they appear in the logs.

What's the difference between this and a crt.sh lookup?

A crt.sh lookup is a point-in-time query for one domain. This actor streams the CT logs themselves — Google, Cloudflare, DigiCert, Sectigo, and TrustAsia — and emits a continuous, delta-since-last-run feed of every certificate matching your watch-list, across every domain those logs see. It's built for continuous monitoring, not a single lookup.

Does this actor scan or contact my domain (or anyone else's)?

No. It only reads public, append-only Certificate Transparency log endpoints (get-sth / get-entries) — the same data every browser and CT monitor relies on. It never sends a request to any certificate subject's domain.

What are precertificates, and why do they matter?

CAs log a "precertificate" to CT logs before issuing the final certificate (required by the CT policy that makes certs trusted by Chrome/Safari). This actor parses precertificates too, so a matching domain shows up in your feed the moment the precert is logged — often seconds before the final certificate is even issued.

How does the cursor / delta work between runs?

Each log gets its own saved cursor (its Merkle tree index) in a persistent key-value store tied to your actor. Every run picks up from where the last run for that log stopped, so you're never re-billed for a certificate you've already seen. A log with no saved cursor yet (first run) starts near the tree's current tip, not from the log's genesis — CT logs hold billions of entries, so a from-genesis backfill would never finish and wouldn't be useful anyway.

Can I restrict which CT log operators are scanned?

Yes — set logOperators to a subset (e.g. ["Google", "Cloudflare"]) to scan only those operators' logs. Leave it empty to scan every currently-usable log across all operators.

---

Need More Features?

Need historical backfill beyond the default lookback window, or a webhook/alert integration on match? File an issue or get in touch.

Why Use Certificate Transparency Log Firehose?

• Pay only for matches — every certificate scanned that doesn't match your watch-list costs nothing; you only pay for the delta that actually matters to you
• No re-billing on schedule — the saved per-log cursor means a recurring run never re-charges for certificates you've already seen
• Passive and safe — reads public log infrastructure only, no scanning or contact with any domain

---

Further reading: Which Web Scraper Do I Need?