How it works
From certificate signal to evidence.
Public certificate transparency means a fake site usually leaves a trace before anyone visits it. Octopus Shield reads that trace, explains it, and keeps it reviewable.
Why certificates come first.
Almost every phishing page is served over HTTPS, and almost every HTTPS certificate is published to public Certificate Transparency logs. That publication often happens before the page has any traffic. Reading those logs is the earliest honest signal available without touching anyone's network.
Discover
Certificate Transparency logs, crt.sh and Censys are read continuously. The log set refreshes itself, so a frozen or retired log does not silently stop collection.
Normalize
Names are folded to a comparable form: homograph characters, leetspeak substitutions, punycode and internationalized domains are resolved before anything is compared.
Score
Each candidate receives a pre-score from string distance, substitution patterns, keyword placement and certificate newness. The contributing signals stay attached to the record.
Observe
Optional, off by default. If enabled, a copied page can report an anonymous, unverified observation — including whether the visitor looked automated or human. No identity is involved.
Evidence
Source, timestamp, certificate reference and the signals behind the score are kept together, so a finding can be reviewed, disputed or handed to a registrar.
Where this approach ends.
An honest method statement includes what the method cannot see.
- A fake site served without HTTPS leaves no certificate trace.
- A certificate issued to a name that does not resemble the brand will not be flagged by similarity.
- Coverage across all issuers and logs has not been measured, so no coverage figure is published.
- Average detection time is not currently measured, so no latency figure is published.