What is Swampcat?
Swampcat is a certificate transparency intelligence platform that maps hidden infrastructure relationships, detects rogue certificates, and audits TLS configurations — all backed by cryptographic evidence from public CT logs.
How It Works
Ingest
We poll configured Certificate Transparency logs in bounded batches and normalize observed certificates, DNS names, issuer names, and public-key identities in PostgreSQL.
Analyze
Swampcat builds an evidence-backed relationship graph, mapping domain-to-certificate associations, public-key reuse across observed certificates, and issuer-name patterns. These are evidence links, not proof of common ownership.
Expose
Active scanning connects directly to target servers, performing live TLS handshakes to detect weak ciphers, expired certificates, protocol downgrades, and certificates not found in CT logs.
Why Swampcat Exists
Detect Unauthorized Certificates
Unexpected certificate or precertificate entries can be a useful investigation signal. Swampcat surfaces configured-log observations and can compare a served certificate with stored CT evidence when active scanning is enabled.
Uncover Shadow IT
CT entries can reveal previously unknown DNS names. Swampcat surfaces those names and their evidence links without assuming that they are currently deployed or controlled by one organization.
Identify Shared Infrastructure
Multiple certificates can share a public key, issuer name, or DNS name. Swampcat makes those observations visible and auditable while leaving control and ownership unresolved.
Audit TLS Posture
Beyond certificate validity, Swampcat's active scanner checks TLS protocol versions and cipher suites. Weak configurations (TLS 1.0, RC4 ciphers) are flagged with an exposure grade so you can prioritize remediation.
Frequently Asked Questions
Ready to explore?
Search any domain to see its certificate history, infrastructure relationships, and TLS exposure grade.