Hunting Related Domains with Certificate Transparency Logs

When a Certificate Authority issues an SSL/TLS certificate, it must publish the certificate to one of several public logs. These Certificate Transparency logs were created in 2013 after the DigiNotar breach to make certificate issuance visible and auditable. The result is a massive, searchable record of every certificate issued for nearly every public website on the internet.

For security researchers, defenders, and curious investigators in Melbourne, Sydney, or anywhere else with a laptop and an internet connection, those logs are a goldmine. Anyone who needs to map a digital footprint, monitor a brand, or hunt for look-alike infrastructure can use the same data that browsers rely on. The trick is knowing where to look and how to interpret what comes back.

What the Logs Actually Record

A Certificate Transparency log is a simple append-only ledger. Certificate Authorities submit every certificate they issue, including the domain names, subdomains, organisation details, and the issuing CA itself. Browsers like Chrome and Firefox refuse to accept certificates that do not appear in a qualifying log, which is why almost every public certificate ends up there within minutes of issuance.

Because the logs are public, anyone can query them. The two most popular frontends are crt.sh, run by Sectigo, and the search interface inside Censys. Both accept a domain and return every certificate that mentions it, including wildcards. Search operators vary slightly between tools, but a simple query such as %.example.com will return certificates for the apex and any subdomains, while a strict query without the percent sign will return exact matches only.

Building a Search Workflow

Start with a known domain that belongs to your target. In Australia, that often means a .com.au address tied to an ABN or registered through an accredited registrar. Enter it into crt.sh and note the issuance dates, the issuing CAs, and the organisation fields. Subdomains like mail., vpn., dev., or staging. will appear in the subject alternative name field, giving you a map of internal-facing infrastructure that you can verify from the outside.

Wildcard certificates are especially valuable. A single certificate for *.example.com.au tells you that the owner was thinking about subdomains broadly, which often hints at hosted platforms, SaaS tenants, or test environments. Filter out obvious CDN entries from Cloudflare, Akamai, and Fastly, then group what remains by naming convention. Patterns emerge quickly: a Brisbane e-commerce operator might run shop., blog., and api. on different infrastructure, all of which will show up under the same certificate.

Spotting Patterns and Anomalies

Once you have a list of certificates, treat the domain names themselves as data. Look for prefixes that suggest business units, regional offices, or product lines. Australian financial services groups often use prefixes like wealth., super., or banking. in their certificate subjects, while state government agencies use departmental acronyms. These conventions can reveal acquisitions, divestments, or shadow IT projects that have not been publicly announced.

The same technique catches typosquats and impersonators. A certificate for examplecom.au or exanple.com.au issued last week is worth investigating, especially if it appears shortly after a marketing campaign. Brand-protection teams at ASX-listed companies monitor these logs continuously, partly because the Notifiable Data Breaches scheme in Australia requires timely reporting when customer-facing look-alike sites collect data fraudulently.

Investigating the Domains You Find

CT logs tell you that a domain exists and has been activated with HTTPS. They do not tell you what is on the domain or who controls it. For that, you pivot to WHOIS, passive DNS services like SecurityTrails or RiskIQ, and basic hosting lookups. A WHOIS record may show a privacy proxy or a registrar in a different jurisdiction, which alone can be a flag.

Hosting details often resolve questions quickly. If a suspicious .com.au resolves to a server in an unexpected geography, or sits behind a parking service that returns a generic landing page, the result is usually benign. Parking services are common endpoints when a domain is reserved but unused, and the parking pages and hosting defaults you encounter during a sweep often indicate an organisation that has registered defensively without yet deploying content. Cross-reference the IP address with Shodan or Censys to see whether the host runs any exposed services, and you have a reasonable picture of risk in under ten minutes.

An Australian Case Study

Consider a fictional Perth-based retailer called Coastal Outfitters. Their security team runs a CT log query for coastaloutfitters.com.au and finds three unexpected certificates issued in the last month: login.coastaloutfitters.com.au, secure-coastaloutfitters.com, and coastalouttfitters.com.au. The first is legitimate and matches a known internal service. The second is on a different TLD entirely, suggesting a phishing setup. The third is a typosquat that registered an extra "t" in the company name.

The team escalates the typosquat to the ACMA and to their legal counsel, who initiates a UDRP complaint or .au domain dispute through auDA. The .com phishing domain is reported to the registrar and to the relevant hosting provider, and the legitimate-looking login. subdomain is confirmed against internal inventory. None of this requires sophisticated tooling, only the willingness to read a CT log every week and act on the deltas. The Australian Signals Directorate's Essential Eight guidance explicitly calls out visibility of internet-facing assets as a baseline control, and CT log monitoring is one of the cheapest ways to satisfy it.

Building Ongoing Monitoring

A one-off search is useful, but the real value comes from continuous monitoring. Several commercial platforms, including Recorded Future, Mandiant Advantage, and the open-source Certspotter tool, will watch CT logs for keywords you specify and alert you when a new certificate mentions your domains. Set the alert window to fire within minutes of issuance, and pair it with a ticketing workflow so that the security team can triage alerts without losing them in chat.

Integrate the alerts with your existing security stack. A webhook into Slack or Teams works for small teams in Adelaide or Hobart, while larger enterprises route findings into a SIEM for correlation with DNS logs and proxy data. Store certificate metadata for at least twelve months so you can spot trends, such as a subsidiary suddenly appearing under its own wildcard certificate. That kind of pattern often signals a reorganisation, a new product launch, or an acquisition that has not been formally announced.

The single thing worth remembering is that Certificate Transparency logs give you, for free, a near-real-time view of how an organisation's web footprint is changing. Used carefully, they let a small Australian security team perform the kind of external reconnaissance that used to require expensive commercial intelligence feeds. The data is public, the tools are accessible, and the competitive advantage belongs to whoever looks at it first.