The certificate transparency API enumerates a domain's subdomains and issued certificates from public CT logs. Because every publicly-trusted TLS certificate must be logged, those logs are the canonical way to discover subdomains without brute-forcing DNS: if a host ever presented a valid certificate, it left a record. Output subdomains returns the distinct hostnames; output certificates returns one row per certificate with its DNS names, issuer and validity window.
It reads the logs through certspotter rather than the frequently-overloaded crt.sh, which is the practical difference between a scan that completes and one that times out. Pass a bare domain, choose the output, and keep include_subdomains on to catch certificates covering *.domain. Every query is fetched over our TLS tier through a rotating residential exit, no browser. Its archival counterpart for the same target is the Wayback Machine API.
$0.0004 per delivered record, up to 500 records per run. Nothing delivered means nothing charged.
You post a domain and pick an output; the collector queries certspotter's CT-log index and shapes the response into a table. It is passive — reading logs, not touching the target's infrastructure.
subdomains gives you the deduplicated list of hostnames, which is what most reconnaissance wants. certificates gives one row per issuance with dns_names, issuer, not_before and not_after.include_subdomains on, certificates issued for *.domain are pulled in too — the whole point of a subdomain sweep rather than an exact-host lookup.Runs up to 100 records return inline; larger enumerations, up to the 500-record ceiling, are queued and delivered on completion.
domain is the only required input; output chooses subdomains or certificates, include_subdomains pulls in *.domain certificates, and max_results caps the run at up to 500 records.
In subdomains mode each row is a distinct subdomain under the queried domain; in certificates mode each row is one issuance with its dns_names, issuer, not_before, not_after and a revocation flag.
$0.0004 per delivered record ($0.40 per 1,000). Nothing delivered means nothing charged, and the $2 monthly free credit covers roughly 5,000 records here. Volume tiers take up to 30% off.
$0.0004 per delivered record — 40 cents per 1,000 rows, where a record is one subdomain or one certificate. Mapping a mid-sized company's external surface is typically a few hundred records, so cents; a domain with a sprawling certificate history is still well under a dollar.
A domain with no logged certificates returns no rows and costs nothing, so probing an unknown target is cheap by design.
The CT ecosystem is open — you can query crt.sh, run your own log monitor, or hit certspotter's API yourself. The reasons teams don't, at scale, are consistency and reliability: crt.sh is notorious for timing out on large domains, raw log output needs deduplicating into a clean subdomain set, and wildcard handling is easy to get subtly wrong.
This collector standardises on certspotter, deduplicates for you, handles the wildcard flag, and returns two clean shapes — a hostname list or a certificate table — under one bill. Fetched through rotating exits, a batch of domains does not become one IP hammering a single log service.
A CT-based subdomain finder is a popular weekend project, and the first version works. The maintenance is in the corners: falling back when crt.sh stalls, deduplicating hostnames that appear across dozens of certificates, deciding what to do with wildcard entries, and paging large histories without dropping records.
Here that is handled and priced per delivered record. If your recon tooling already exists and only needs a dependable network beneath it, our residential proxies are that layer — and CT logs are one input among many an attack-surface map draws on.
Enumerate a domain's subdomains from CT logs as the first pass of an external footprint — the hosts a target has exposed, discovered passively without sending a packet to their DNS.
In certificates mode, list every issuance with its issuer and not_after date to audit which CAs have signed for a domain and what is about to expire.
Watch for newly-logged certificates whose DNS names resemble your brand, an early signal of lookalike domains being stood up for phishing.
CT logs only show hosts that were issued a publicly-trusted certificate, so this finds those and nothing else: a subdomain served over plain HTTP, behind an internal-only CA, or hidden under a wildcard it never individually certified will not appear. It is passive reconnaissance from public logs — powerful for discovery, but not a complete map of a network and not a vulnerability scan.
One run caps at 500 records; very large certificate histories are more runs. Enumerating your own or an authorised target's surface is standard security practice — doing it to systems you have no permission to test may not be, so stay on the right side of that line. This is not legal advice.
CT logs are public. Here light use falls under the $2-a-month free allowance — about 5,000 records at $0.0004 each — after which it is pay-as-you-go with no subscription.
Yes, in effect. It reads the same CT-log data crt.sh exposes but through certspotter, chosen because crt.sh frequently times out on large domains, and it returns deduplicated, typed rows instead of raw output you have to clean.
Set output to subdomains and keep include_subdomains on. You get the distinct hostnames that have appeared in logged certificates for the domain, including those covered by *.domain wildcards — no brute-force wordlist involved.
No source does. CT logs reveal hosts that were issued a publicly-trusted certificate; anything served over plain HTTP or via an internal CA leaves no CT record and cannot be found this way. It is thorough for certificate-bearing hosts, not exhaustive for all of them.