Certificate Transparency Subdomain Search (crt.sh alternative)
Under maintenancePricing
Pay per usage
Certificate Transparency Subdomain Search (crt.sh alternative)
Under maintenanceFind subdomains and TLS certificates for any domain from Certificate Transparency logs. A fast, working crt.sh alternative for subdomain enumeration, recon and attack-surface mapping. Returns unique hostnames with first/last seen and issuers, or raw certificates.
Pricing
Pay per usage
Rating
0.0
(0)
Developer
Sevastian Z
Maintained by CommunityActor stats
0
Bookmarked
1
Total users
0
Monthly active users
4 days ago
Last modified
Categories
Share
Find every subdomain and TLS certificate issued for a domain, straight from public Certificate Transparency logs. A fast, working alternative to crt.sh for subdomain enumeration, recon, attack-surface mapping and asset discovery.
Every publicly trusted certificate is logged in Certificate Transparency. That makes CT logs one of the best sources for discovering the hostnames an organization actually uses, including forgotten staging, dev and internal subdomains.
What it does
- Queries CT logs for a domain (and optionally its subdomains).
- Returns either:
- Unique hostnames (default): one row per hostname, deduplicated, with how many certificates referenced it, first/last seen dates and issuers. Ideal for subdomain enumeration.
- Raw certificates: one row per certificate, with all SAN names, issuer and validity window.
- Wildcard certificates (
*.example.com) are flagged.
Input
| Field | Type | Description |
|---|---|---|
domain | string, required | Domain to search, e.g. example.com |
includeSubdomains | boolean | Also include certificates issued for subdomains (default true) |
output | names | certificates | Aggregate to unique hostnames, or return raw certificates (default names) |
Output (names mode)
| Field | Description |
|---|---|
name | discovered hostname |
wildcard | a wildcard certificate covered this name |
cert_count | how many certificates referenced it |
first_seen / last_seen | earliest / latest certificate not_before |
issuers | certificate authorities that issued for it |
Use cases
- Subdomain enumeration for recon and bug bounty.
- Attack-surface and asset discovery for security teams.
- Monitoring which CAs issue certificates for your domains.
Related: catch domains impersonating you
CT search finds certificates for your domain. Attackers register lookalike and typosquatted domains and get their own certificates to phish your users. To detect those, scan with Lookalike / Typosquat Domain Scan — it generates lookalike permutations, verifies registration via DNS and RDAP, and scores phishing risk.
Notes
Data comes from public Certificate Transparency logs via the Cert Spotter API. The free tier is rate-limited; if you hit a rate limit, retry in a minute.
