Cerberus CT uses multiple detectors and enrichment layers. Each detector produces a Finding. Findings for the same domain can be grouped into a DomainAlert.
domain normalized domain
detector detector name
severity info, low, medium, high, or critical
score numeric score from 0 to 100
reasons human-readable reasons
evidence structured evidence values
Looks for configured suspicious words such as:
login
verify
secure
account
reset
support
wallet
password
billing
invoice
auth
signin
Looks for configured brand names in observed domains.
Compares domain labels and useful hyphenated tokens to configured official domains.
Example:
paypa1-login.com → paypal.com
Flags IDN/punycode and non-ASCII risk.
Example:
xn--example.com
Scores suspicious domain construction patterns that are weak alone but meaningful together:
paypal-secure-login.com
paypa1-login.com
login.account-reset.example
The detector emits explainable evidence for combinations such as protected-name plus security-action terms, digit substitutions, excessive hyphenation, deep label nesting, and high-abuse campaign TLDs.
When enabled, Cerberus adds DNS evidence:
dns.resolved
dns.ip
dns.cname
dns.error
When enabled, Cerberus checks CNAMEs against known third-party provider fingerprints. It only reports candidate risk conservatively and avoids flagging resolved CNAME targets as takeover candidates.
The fingerprint dataset is checked in under crates/cerberus-core/data/ and can be refreshed from the upstream community source with:
./scripts/update_takeover_fingerprints.ps1rules.min_score suppresses low-score alerts.
rules.allowlist_suffixes suppresses trusted suffixes and helps reduce noise from known infrastructure.