Skip to content
Use case 03 · Phishing certificates

Every new certificate checked as it appears.

“Phishing sites go live faster than we can check them.” 6 million new certificates a day. VAKYN checks every one as it appears.
Try itSee the questions
  • lookalike(certificate) → noul
  • imitates(certificate) → choice
  • risk(certificate) → score
One request, 3 questions. The state is read once.
The problem

“Phishing sites go live faster than we can check them.”

  • The volume

    6 million new certificates a day. A few are for look-alikes of your bank, your courier, your tax office.

    Public Certificate Transparency statistics.

  • The trade-off

    Keyword rules are quick but flag the real sites and miss misspellings. An LLM gets it right, but it is too slow and costly to ask about every certificate.

  • With VAKYN

    Every certificate is checked as it appears. The sure look-alikes are blocked. The unsure ones go to an LLM or an analyst. Intelligence thinks. Intuition decides.

The questions

3 questions, one request.

The state is the new certificate's domains, with the brands you protect. Each question has fixed answers: noul for yes or no, choice to pick one, score for a level.

  1. 01

    lookalike

    Does a domain on this certificate imitate one of the protected brands without belonging to it?

    Answers with the probability of yes, from 0 to 1.

    noul
  2. 02

    imitates

    Which kind of organization does the certificate imitate?

    • bank
    • courier
    • public_office
    • none
    choice
  3. 03

    risk

    How likely is this certificate to be used for phishing?

    1. 0Unlikely
    2. 1Possible
    3. 2Very likely
    score
A sample state

A clear case and a borderline one.

A certificate as it appears: blocked when VAKYN is sure, sent to an analyst or an LLM when it isn't.

state · JSON

{
  "protected_brands": [
    "Brightwater Bank: brightwaterbank.com",
    "ParcelFox: parcelfox.com",
    "National Revenue Office: revenue.gov.example"
  ],
  "certificate": {
    "logged": "2026-10-11T03:12:44Z",
    "issuer": "a free automated certificate authority",
    "domains": [
      "brightwaterbank-secure-login.com",
      "www.brightwaterbank-secure-login.com",
      "verify.brightwaterbank-secure-login.com"
    ]
  }
}

Answers · how sure

  • lookalikeyes0.94
  • imitatesbank0.95
  • riskVery likely0.95

Acts automatically. Every answer is at least 0.70 sure. Block the look-alike domains, or let the certificate pass.

Run this case in the playground

Real answers from VAKYN-4B Q8_0, 2026-10-11. The bar's line marks 0.70. The playground runs VAKYN MAX, so its numbers can differ. Names, companies and domains are made up.

The decision

Act on the sure answers.

VAKYN answers; your code decides. The rule here: act when every answer is at least 0.70 sure. Move the threshold to send more or fewer cases to a person.

  • Every answer ≥ 0.70

    Block the look-alike domains, or let the certificate pass.

  • Any answer below

    An LLM or an analyst takes a closer look.

Try it in the playgroundSign in to the console; the sample opens ready to run on VAKYN MAX and is charged like any call.