Catch phishing domains impersonating your brand each morning

Every weekday at 8am, hunt for newly issued TLS certificates that impersonate our brand and alert our security team about the genuinely new ones. Use a cron trigger set to weekdays at 8am. Ask me at setup for our brand terms, our own domains, and our known partner domains, and keep the last two as an allowlist.

Discovery. Use the Censys "Run a Search Query" operation with a CenQL query that regex-matches our brand terms across certificate names and DNS names. Model the query on the progressive-filter shape Censys recommends in their own phishing-prevention writeup, replacing acme with our brand term: ((services.tls.certificate.names=/(.*acme.*)/ or name=/(.*acme.*)/ or dns.names=/(.*acme.*)/ or dns.reverse_dns.names=/(.*acme.*)/)). Build regex variations that catch typosquat and lookalike patterns: character swaps, doubled or omitted letters, homoglyph-style substitutions, added words like login, secure, account, verify, pay, billing and support, alternate TLDs, and hyphenated forms of our name. Censys receives certificates and their SubjectAltNames from certificate transparency logs in near real time, so this catches impersonation infrastructure before it is weaponized rather than after.

Filtering. Drop every result that matches one of our own domains or a known partner domain from the allowlist. Everything that remains is a candidate impersonation.

Enrichment. For each candidate, call the VirusTotal "Get a Domain Report" operation to see how many security engines already flag it (read the malicious and suspicious counts under last_analysis_stats) and to pull resolution detail showing whether the domain currently points at a live host. Then call the Censys "Get a Certificate" operation with the certificate's SHA-256 fingerprint to get the issuer organization and the validity period. VirusTotal's free tier allows roughly 4 requests per minute and 500 per day, so pace these lookups and cap the number of candidates enriched per run (25 is a sensible default) instead of letting the run fail on rate limits.

Deduplication, and this step is load-bearing rather than decorative. Before creating anything, use the Notion "Query a Data Source" operation against our "Brand Impersonation Watchlist" data source, filtering on the certificate fingerprint, to check whether we have already logged this certificate. Skip every certificate that is already present. Without this check the workflow re-alerts on the same lookalike certificate every single morning, and the team mutes the channel inside a week.

Logging. For each genuinely new finding, use the Notion "Create a Page" operation to add a row to the Brand Impersonation Watchlist recording the certificate SHA-256 fingerprint, the lookalike domain, the issuing certificate authority, the hosting IP, the VirusTotal verdict (malicious and suspicious counts out of total engines), the severity you assigned, and the date first seen. Log every new finding here regardless of severity.

Severity. Assign high, medium or low yourself, weighing three things: whether the certificate is already resolving to a live host, since live infrastructure is materially more dangerous than a parked or unresolved name; whether the issuer is a free certificate authority commonly abused for phishing, such as Let's Encrypt or ZeroSSL; and whether the name pattern targets a login or payment page, using tokens like login, signin, secure, verify, account, pay and billing. A live host on a free certificate with a login-themed name is high. An unresolved name with none of those signals is low. Existing VirusTotal detections should push severity upward.

Alerting. Finish with exactly one Microsoft Teams message using the "Create Channel Message" operation to our security channel, listing only the new high and medium severity impersonations. Give each one a single line: the lookalike domain, its severity, and a one-line reason such as "live host, free certificate, login-themed name". Reference the Notion page for full detail. Low severity findings are logged to Notion but never posted.

Silence on quiet days. If there are no new findings after deduplication, or no new findings that reach high or medium severity, post nothing at all. Do not send a "nothing to report" message and do not post an empty summary. Complete the run silently. Microsoft's terms also prohibit using Teams as a log file, so only ever send messages a human will actually read.