Early warning for Irish brand impersonation, read from public Certificate Transparency logs — where a phishing domain appears before the scam goes live.
Tested on 2,000 domains — 1,000 known phishing, 1,000 legitimate sampled from Tranco ranks 20k–300k so the control group is genuinely hard. Compared against the keyword-and-edit-distance approach existing certificate-log tools use.
| Stratum | n | Jev | Baseline |
|---|---|---|---|
| English | 500 | 22.0% | 3.8% |
| Non-English | 400 | 18.8% | 2.2% |
| Punycode | 100 | 38.0% | 23.0% |
| All | 1000 | 22.3% | 5.1% |
Punycode is where it wins outright.
Homoglyph attacks — xn--wkipedia-c2a.org is "wikipedia" with a
substituted character — are semantic by construction, and the substitution
is the attack. A keyword list cannot see it.
What it misses. Recall is 22%, and that
half is not recoverable: phishing hosted on github.io or
repl.co carries no signal in the domain name, because the
domain belongs to GitHub rather than the attacker.
These domains resemble Irish brands and have been scored by an automated model. Some will be legitimate businesses. Nothing here is an accusation. If your domain is listed in error, open an issue on the repository and it will be removed.