TLS Certificate Lookup — Certificate Transparency API

Enumerate any domain's real subdomains from the free, public Certificate Transparency log API (certspotter) — no login, no scraping. Every subdomain returned had an actual TLS certificate issued for it. Pay only when subdomains are found; domains with no CT history cost nothing.

Point it at a list of domains. Get registrar/age, DNS, a real TLS handshake, and detectable tech — pay only for modules that return. No browser, no proxy bill.

crt.sh Certificate Transparency Scraper

parseforge/crtsh-certificate-transparency-scraper

Search crt.sh certificate transparency logs for a domain and discover subdomains. Get common name, SANs, issuer, validity dates, and serial number per certificate.

One domain in, seven signals out: RDAP registration, DNS and email provider, tech stack, Shopify storefront presence, TLS certificate history, ATS hiring signal, and an email-route/provider fingerprint. Each source is billed separately, only when it actually returns data.

Day-zero startup leads from Certificate Transparency: crt.sh finds domains whose FIRST TLS cert was just issued, we enrich each new site's OWN website with MX/DNS-verified emails + phones + socials + tech stack + A-D launch-readiness. Be first to a newly-launched business. Per-result, no keys.

Certificate Transparency Scraper: Subdomain Discovery

arman-bd/certificate-transparency-scraper

Query certificate transparency logs via crt.sh to enumerate subdomains, issuers, validity windows and certificate history for any domain. Passive attack-surface discovery. no login, no proxy, no browser.

Certificate Transparency Monitor — AI Agent Recon API

logiover/certificate-transparency-monitor

Keyless certificate transparency intelligence for AI agents: crt.sh CT logs. Track new TLS certs for any domain, discover subdomains via wildcard, batch domains. Issuer, validity, SAN domains and serial per row. No API key, no browser.

Sublist3r Subdomain Finder & Takeover Scanner

datacach/sublist3r-subdomain-finder

Subdomain enumeration from passive OSINT sources — certificate transparency logs, passive DNS and public APIs — with optional active HTTP/TLS fingerprinting of every live host, scored for takeover risk. Run it only against domains you are authorized to assess.

Scrape SSL/TLS certificate transparency logs from crt.sh for any domain. Great for security audits and subdomain discovery. Returns common name, subdomains (SANs), issuer and validity. Pay per certificate; empty runs free.

Certificate Transparency & Subdomain Discovery Scraper

scrapers_lat/certificate-transparency-scraper

Discover subdomains and SSL/TLS certificates for any domain from public certificate transparency logs. Extract SAN hostnames, issuer, validity dates, wildcard and expiry flags. Perfect for attack-surface mapping, OSINT and asset inventory. Export to JSON, CSV or Excel.