x0rz/phishing_catcher

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1819 stars · 359 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Python CLI tool that monitors TLS certificate issuances in near real time via the CertStream API and flags suspicious domains using a configurable keyword-scoring system. It serves as a proof-of-concept for detecting potential phishing domains as they are registered in the Certificate Transparency Log.

Use cases

• detect newly issued phishing domains in real time
• monitor certificate transparency logs for suspicious domains
• score domains for phishing likelihood based on keywords
• feed threat intelligence workflows with early phishing warnings
• run a dockerized phishing domain watcher
• customize keyword scoring rules for brand protection

When to choose

• you want near-real-time alerts on suspicious TLS certificate issuances
• you need a lightweight, scriptable phishing domain detector
• you want to customize scoring rules via simple YAML config
• you work in threat intelligence or OSINT and monitor domain abuse

When to avoid

• you need a full phishing detection platform with takedown and reporting features
• you require low false positives out of the box without tuning
• you need a GUI or managed service rather than a PoC script
• you want passive DNS or URL content analysis rather than certificate-based detection

Facets

cli-tool · maturity maintenance

osint security monitoring streaming security osint python cli cross-platform certstream certificate-transparency phishing-detection threatintel domain-monitoring threat-intelligence phishing docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="x0rz/phishing_catcher")