Most fake domains obtain a certificate before they go live. That is a window to see the campaign before its victims do.
Certificate transparency logs are public and close to real time. When an attacker wants to serve a fake login page over HTTPS, they leave a record after registering the domain but before the campaign starts.
What to watch
- Keyboard adjacency — swapping neighbouring keys.
- Homoglyphs — visually similar characters; for Turkish the ı/i and ş/s pairs are particularly productive.
- Added words — login, online, support or campaign appended to the brand name.
- Different TLD — the same name under another extension.
Reducing the noise
The raw match list is very large. Three filters make it workable: does the domain have an A record, does the page host the brand logo, and have the registrar and host been tied to campaigns before.
A takedown note
Subdomain impersonation (brand-login.othersite.com) is outside the registrar's authority. There you go straight to the host, which takes longer, so user-side blocking should run in parallel.
