Infrastructure
What is Certificate transparency?
Public, append-only logs of every TLS certificate issued by trusted authorities, searchable to discover domains and subdomains.
Certificate transparency is a system of public, append-only logs where certificate authorities record every TLS certificate they issue. Browsers require it, so almost every certificate for a public website ends up in these logs.
For analysts, CT logs are a discovery tool. Searching them, for example through crt.sh, reveals subdomains an organisation forgot about and lookalike domains that attackers have just obtained certificates for, often before the phishing site goes live.