certgrep - Search Certificate Transparency Logs

TL;DR

TL;DR: certgrep.sh searches Certificate Transparency logs to surface domain squatting, typosquatting, and phishing domains that mimic your brand — free for anyone with a domain to protect.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: certgrep.sh — verified, live product
• Source repository: No public GitHub repo (the parent project Have I Been Squatted has GitHub org with twistrs MIT, haveibeensquatted-python MIT, spider MIT — certgrep itself is not open source)
• License: Not applicable (SaaS tool, no license file)
• HN launch thread: news.ycombinator.com/item?id=46928648 — from current search results
• Source last checked: 2026-07-06

What Is certgrep?

Certificate Transparency (CT) logs are public, append-only records of every TLS certificate issued by a Certificate Authority. Since 2013, most public CAs are required to submit certificates to CT logs, making them a rich audit trail of all HTTPS domains ever created.

certgrep.sh taps this trail directly. Enter a brand name, domain pattern, or regex, and it returns every certificate issued matching that query — including domains you never registered but an attacker did in your name.

The tool is a project by Have I Been Squatted, the same team behind the twistrs Rust library (MIT, 134 stars) for domain permutation and enumeration.

How It Works

Certificate Transparency logs are designed to be publicly queryable. certgrep provides a structured search interface on top of them:

# Search for domains matching a pattern (via the web UI)
# Enter patterns like:
#   example.com
#   examp1e.com
#   mybrand-*.com
#   .*phishing.*

Results show each matching domain, the Certificate Authority that issued it, and the issuance date — letting you spot look-alike domains before they are used in phishing campaigns.

Use Cases

Typosquatting detection

Brands with common misspellings (e.g., facebok.com, gogle.com) can search CT logs for all permutations and file UDRP complaints against the worst offenders.

Phishing infrastructure tracking

When a phishing campaign impersonates your brand, the attacker needs a TLS certificate. CT logs record it. certgrep surfaces it, often within hours of the certificate being issued.

Supply chain security

Search for look-alike domains targeting your developers or customers — npmjs-*.com, pypi-*.net, docs-*-verify.com — before attackers set up convincing phishing pages.

Interface

The web interface at certgrep.sh provides:

• A pattern input with regex support
• A log selector (choose which CT logs to search)
• A results table with domain, CA, and issuance timestamp
• Sign-in via Clerk for saving searches and setting up alerts

The UI is dark-themed, minimal, and fast — searches return within seconds against billions of logged certificates.

Pricing

certgrep is free to use for basic searches. The team behind it offers paid brand protection services through haveibeensquatted.com for ongoing monitoring and takedown assistance.

Practical Evaluation Checklist

• Does a basic search return results within 5 seconds?
• Does the results table clearly show domain, CA, and date?
• Does regex pattern matching work as expected?
• Are results paginated or load-more for large result sets?

Security Notes

CT logs are public by design. Searching them reveals only domains that have been issued TLS certificates — no DNS queries, no active scanning. The data is read-only and does not reveal server infrastructure behind any domain.

certgrep itself uses Clerk for authentication. The search queries you run are associated with your account.

FAQ

Q: Does certgrep scan for domains that do not have TLS certificates? A: No. It searches only Certificate Transparency logs, which only contain domains that have been issued a certificate. Subdomain takeovers without TLS are not covered.

Q: How is this different from Have I Been Squatted? A: Have I Been Squatted (haveibeensquatted.com) proactively monitors CT logs for specific brands and alerts owners when look-alike certificates appear. certgrep.sh is the public search tool anyone can use to manually query CT logs for any pattern.

Q: Is there an API? A: Not publicly documented. The Have I Been Squatted API (Python SDK available at github.com/haveibeensquatted/haveibeensquatted-python) covers squatting checks, not raw CT log search.

Conclusion

certgrep fills a specific, high-value niche: freely accessible Certificate Transparency search without needing to operate your own CT log scanner. For security teams, brand protection officers, and developers concerned about look-alike domains, it is a bookmark-worthy tool — especially given the parent project’s proven track record in domain security tooling.