ArgusLeaf
Technical overview
From log entry
to your inbox.
A complete walkthrough of how ArgusLeaf processes certificate transparency data and delivers alerts.
The source
Every certificate is public.
When a website obtains a TLS certificate from any trusted Certificate Authority, that certificate is logged to one or more public Certificate Transparency (CT) logs before the CA issues it. This is required by browser policy — Chrome, Firefox, and Safari refuse certificates that aren't logged.
As of 2026, CT logs collect roughly 5–10 million new certificate entries per day. ArgusLeaf reads these logs continuously using the RFC 6962 tile-based streaming protocol, processing each leaf entry as it appears.
Detection
Similarity, not rules.
We don't maintain a blocklist of "known bad" domain patterns. Instead, every new domain name is scored against each tenant's watch-list using a weighted combination of signals:
| Signal | Weight | What it catches |
|---|---|---|
| Edit distance (Levenshtein) | 40 | Transpositions, character additions / removals |
| Trigram overlap (pg_trgm) | 20 | Language-model similarity |
| TLD swap | 15 | brand.com → brand.net / .io / .org |
| Homograph / IDN confusables | 25 | Punycode look-alikes (аррle.com vs apple.com) |
| Subdomain of brand | 30 | brand.attacker.com |
| Brand in subdomain | 20 | attacker.brand.com |
| Prefix / suffix abuse | 15 | secure-brand.com, brand-login.com |
| Fresh registration | 10 | Domain < 7 days old |
| MX record present | 10 | Active mail server = operational threat |
Thresholds: score ≥ 90 → immediate alert · 50–89 → daily digest · < 20 → discarded.
ArgusLeaf applies a character skeleton map before scoring:
ç→c, ğ→g, ı→i, ö→o, ş→s, ü→u.
This means güvenlik and guvenlik score as
near-identical — a detection most global tools miss entirely.
Context
More than a name.
High-scoring domains are enriched with additional context before alerting:
- DNS records (A, MX, NS, TXT)
- WHOIS registration date
- HTTP response — status, title, final redirect URL
- Favicon hash (to detect brand logo reuse)
- Matching threat intelligence feed entries
All outbound connections use a safe dialer that validates resolved IPs against SSRF-protection rules — private and loopback addresses are never contacted.
Delivery
Email, nothing else.
-
Immediate alert (score ≥ 90)
Sent within minutes of detection. Contains the domain name, score breakdown, enriched context, and a clear disclaimer: this is an automated signal, not a verdict.
-
Daily digest (score 50–89)
A single email covering all medium-confidence findings from the past 24 hours. Grouped by confidence band for easy triage.
-
Monthly report
Issued even for quiet months. "Nothing found" is data — it tells you your brand was not significantly imitated in that period.
Verification
Prove what you own.
Before monitoring begins, you must add a DNS TXT record to your domain:
argusleaf-verify=YOUR_TOKEN
We poll for this record and activate monitoring only after it's confirmed. This prevents anyone from subscribing to someone else's threat picture — no exceptions.