# Certificate-Transparency Newly-Launched Startup Lead Extractor (`ayeeyee/ct-newly-launched-startup-lead-extractor`) Actor

Day-zero startup leads from Certificate Transparency: crt.sh finds domains whose FIRST TLS cert was just issued, we enrich each new site's OWN website with MX/DNS-verified emails + phones + socials + tech stack + A-D launch-readiness. Be first to a newly-launched business. Per-result, no keys.

- **URL**: https://apify.com/ayeeyee/ct-newly-launched-startup-lead-extractor.md
- **Developed by:** [Virtual Footprint LLC](https://apify.com/ayeeyee) (community)
- **Categories:** Lead generation, Business, Marketing
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $8.00 / 1,000 newly-launched startup lead with contacts

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Certificate-Transparency Newly-Launched Startup Lead Extractor

Turn the **Certificate-Transparency log firehose** into verified **day-zero startup sales leads**. Every time a new business stands up a website it secures a TLS certificate — that issuance is recorded publicly in the CT log before the site even has a homepage. This Actor finds domains whose **first TLS certificate was just issued**, then enriches each newly-launched site's OWN website with **MX/DNS-verified decision-maker emails**, phones, socials, tech stack, and an **A-D launch-readiness grade**.

**Be first to a newly-launched business.** "New businesses spend the most in their first 30 days — be there when vendor decisions are made" is the thesis behind a whole SaaS tier (New Business Radar, FeedLead, Letrics) that sells day-zero newly-launched-business leads monthly. This Actor delivers the same signal per-result, with verified contacts, at a fraction of the cost.

### What makes it different

The existing CT/cert actors on the store (`ryanclinton/crt-sh-search`, `parseforge/crtsh-certificate-transparency-scraper`, `perryay/subdomain-enumeration-ct-logs`, `scrapemint/newly-registered-domain-leads`) all hand you **raw certificate rows** or a raw cert dump. **None of them hand you a lead.** This Actor is the only one that:

- computes the **earliest-cert date** per registrable domain (the real "first seen in CT" day-zero signal — not just the latest cert);
- rolls subdomains up under the apex (wildcards stripped) — one lead per *business*, not a row per cert;
- enriches the newly-launched site's **OWN website** for **MX/DNS-verified decision-maker emails**, phones, socials, and tech stack;
- grades each lead **A-D for launch-readiness** (earliest-cert recency + contactability + subdomain traction);
- charges **per verified-contact lead** (you don't pay for domains with no live site or no contact — honestly dropped, not billed).

### How it works

1. **Discovery** — queries the public keyless [`crt.sh`](https://crt.sh) CT-log search:
   - **Explicit `domains`** list → one cert-history fetch per apex (score + enrich a known domain list).
   - **`searchQuery`** (keyword or SQL-LIKE pattern such as `ai`, `openai`, `%.dev`, `%.ai`) → discover newly-secured apices across the whole CT log, apex-deduped, known-big infrastructure domains dropped.
2. **Day-zero signal** — for each apex, computes `earliestCertDate` (first TLS cert = when the business stood up the domain), `latestCertDate`, `certCount`, top issuer, and the discovered `subdomains`.
3. **Enrichment** — fetches `https://<apex>` (and a `www.` fallback) and runs the proven enrichment layer: MX/DNS-verified emails, NANP phones, social profiles, tech-stack fingerprint, A-D lead score.
4. **Launch-readiness grade** — A-D from earliest-cert recency + contactability + subdomain traction, plus a `newlyLaunched` boolean when the first cert falls within your window.

No third-party API keys, no residential proxy, no compose cost. **CT logs are public-by-design** (that is their purpose) — the lowest-ToS-risk discovery surface in the lead-gen portfolio. Contact always comes from the newly-launched site's own public pages (same posture as the website-contact actor); the CT log carries only domain names, never personal data.

### Input

| Field | Type | Default | Description |
|---|---|---|---|
| `domains` | string\[] | `[]` | Explicit domains/URLs to score + enrich (one lead per registrable apex). |
| `searchQuery` | string | `""` | crt.sh keyword or SQL-LIKE pattern (`openai`, `%.dev`, `%.ai`) to discover apices across the CT log. |
| `newlyLaunchedWithinDays` | int | `30` | Flag apices whose first cert was issued within the trailing N days. In search mode, also pre-filters to only day-zero apices. `0` disables. |
| `maxDomains` | int | `25` | Cap on apices enriched (after dedupe + filters). Max 100. |
| `dropKnownBig` | bool | `true` | In search mode, drop known-big infrastructure domains (google.com, shopify.com, cloudflare.com, …). |
| `verifyEmails` | bool | `true` | MX/DNS-validate the best contact email's domain. |
| `concurrency` | int | `3` | Apices/sites processed in parallel (1-6). |
| `proxyConfiguration` | object | `{}` | Optional; only if you hit IP rate limits. |

Provide `domains` and/or `searchQuery` (at least one).

### Output schema

One record per registrable apex that has a live, contactable website:

| Field | Type | Description |
|---|---|---|
| `domain` | string | Registrable apex (the newly-launched business domain). |
| `companyWebsite` | string | `https://<apex>` (or `www.` variant if that's what served). |
| `earliestCertDate` | string|null | First TLS cert issuance date (YYYY-MM-DD) — the day-zero signal. `null` if crt.sh could not be reached. |
| `latestCertDate` | string|null | Most recent cert issuance date. |
| `certCount` | int | Number of cert rows observed for this apex. |
| `issuerTop` | string|null | Most common certificate issuer (CA), short label. |
| `subdomains` | string\[] | Discovered subdomains (api., docs., app., …) — a traction/infrastructure signal. |
| `subdomainCount` | int | Count of discovered subdomains. |
| `newlyLaunched` | bool | True if `earliestCertDate` is within the window. |
| `emails` | string\[] | MX/DNS-cleaned contact emails (host-domain emails ranked first). |
| `emailVerified` | bool | True if the best email's domain has live MX/DNS. |
| `phones` | string\[] | NANP phones found on the site. |
| `socials` | object | `{facebook, instagram, twitter, linkedin, youtube, tiktok, pinterest}` profile URLs. |
| `techStack` | string\[] | Detected technologies (Stripe, Cloudflare, React, Klaviyo, …). |
| `launchReadiness` | string | A-D launch-readiness grade. |
| `launchLabel` | string | Plain-English explanation of the grade. |
| `leadScore` | string | A-D signal-richness lead score. |
| `hasContact` | bool | True if any email/phone/social was found (the billing gate). |

Apices with **no live website or no contact** are honestly dropped (not billed, not emitted).

#### Launch-readiness grades

- **A — Peak day-zero:** first TLS cert within the window + verified website contact + subdomain traction. Newly launched and reachable.
- **B — Fresh launch:** first cert within the wider recent band + contactable. Good newly-launched prospect.
- **C — Established but contactable:** older apex (not newly launched) with a verified contact.
- **D — Weak:** no website contact found; CT data only, not billed as a verified lead.

### Pricing (pay-per-event)

| Event | Price | When charged |
|---|---|---|
| **Startup Lead with Contact** (primary) | **$0.008** | Once per apex that returns a real contact signal (email/phone/social). |
| Verified Startup Email | $0.003 | When the lead yields an MX/DNS-validated email. |
| Newly-Launched Signal | $0.001 | When the apex's first cert falls within your window. |
| Actor Start | $0.0001 | One-time per run. |

**You only pay for leads with a real contact.** Domains with no live site or no contact are dropped, not billed. Zero upstream compose cost (keyless crt.sh + each site's own public pages) → margin-positive from day one.

### Real-run sample

All three records below are copied verbatim from actual live Apify runs on 2026-08-04 (subdomains truncated to the first few for readability). Nothing is fabricated.

#### 1. Day-zero lead (the wedge) — `searchQuery: "openai"`, `newlyLaunchedWithinDays: 30`

`droplive.io` — a domain whose **first TLS certificate was issued 2026-07-08 (27 days ago)**, with an MX-verified contact email. This is the day-zero signal: a business that just stood up its domain.

```json
{
  "domain": "droplive.io",
  "companyWebsite": "https://droplive.io",
  "earliestCertDate": "2026-07-08",
  "latestCertDate": "2026-07-08",
  "certCount": 2,
  "issuerTop": "Let's Encrypt",
  "subdomains": ["corpus-openai-assistants-quickst--ben.eu1.dev.droplive.io"],
  "subdomainCount": 1,
  "newlyLaunched": true,
  "emails": ["hi@droplive.io"],
  "emailVerified": true,
  "phones": [],
  "socials": {},
  "techStack": [],
  "launchReadiness": "B",
  "launchLabel": "Fresh launch — first cert within the wider recent band + contactable; good newly-launched prospect.",
  "leadScore": "B",
  "hasContact": true
}
```

#### 2. Established domain, rich cert stats — `domains: ["anthropic.com"]`

`anthropic.com` — an older apex (first cert 2021) surfaced via explicit mode, showing the full cert-history rollup: 3,915 certs, 130 subdomains, top issuer, socials, tech stack. `newlyLaunched: false` (honest — it's not a day-zero lead).

```json
{
  "domain": "anthropic.com",
  "companyWebsite": "https://anthropic.com",
  "earliestCertDate": "2021-01-27",
  "latestCertDate": "2026-08-03",
  "certCount": 3915,
  "issuerTop": "Let's Encrypt",
  "subdomains": ["a-api.anthropic.com", "a-cdn.anthropic.com", "alignment.anthropic.com", "api.anthropic.com", "console.anthropic.com", "docs.anthropic.com"],
  "subdomainCount": 130,
  "newlyLaunched": false,
  "emails": [],
  "emailVerified": false,
  "phones": [],
  "socials": {
    "linkedin": "https://www.linkedin.com/company/anthropicresearch",
    "twitter": "https://x.com/AnthropicAI",
    "youtube": "https://www.youtube.com/@anthropic-ai"
  },
  "techStack": ["Cloudflare", "HubSpot", "Webflow"],
  "launchReadiness": "C",
  "launchLabel": "Established but contactable — older apex (not newly launched) with a verified website contact.",
  "leadScore": "C",
  "hasContact": true
}
```

#### 3. Verified decision-maker email + clean enrichment — `domains: ["clerk.com"]`

`clerk.com` — first cert 2022, 1,220 certs, 41 subdomains, MX-verified `privacy@clerk.com`, real socials (twitter resolved to the company profile `x.com/clerk`, not a tweet URL), leadScore A. (Note: Clerk's auth docs emit example emails like `cameron@work.com` / `example@gmail.com` — those are filtered out as doc placeholders, not billed.)

```json
{
  "domain": "clerk.com",
  "companyWebsite": "https://clerk.com",
  "earliestCertDate": "2022-11-30",
  "latestCertDate": "2026-08-01",
  "certCount": 1220,
  "issuerTop": "Let's Encrypt",
  "subdomains": ["accounts.clerk.com", "api.clerk.com", "beta.clerk.com", "cdn.discord.clerk.com", "dashboard.clerk.com", "docs.clerk.com"],
  "subdomainCount": 41,
  "newlyLaunched": false,
  "emails": ["privacy@clerk.com", "cameron.walker@gmail.com"],
  "emailVerified": true,
  "phones": [],
  "socials": {
    "twitter": "https://x.com/clerk",
    "linkedin": "https://www.linkedin.com/company/clerkinc",
    "youtube": "https://www.youtube.com/@clerkdev"
  },
  "techStack": ["React"],
  "launchReadiness": "C",
  "launchLabel": "Established but contactable — older apex (not newly launched) with a verified website contact.",
  "leadScore": "A",
  "hasContact": true
}
```

**Run cost for sample #1** (1 day-zero lead, 1 verified email, 1 newly-launched signal): $0.008 + $0.003 + $0.001 = **$0.012**. Domains with no live site or no contact are dropped, not billed.

### Performance & cost

- **Latency:** dominated by crt.sh (a free, per-IP-rate-limited service; ~5-15s per query, retried with backoff on 502/404) + the per-apex website fetch. A 25-apex run typically completes in 1-3 minutes.
- **Cost:** at $0.008/lead + $0.003/verified-email, a run returning 10 contactable day-zero leads costs ~$0.11. No proxy, no compose cost.
- **Honest caps:** crt.sh intermittently returns 502/404 under load → the Actor retries up to 5× with exponential backoff and, if a query still cannot be satisfied, degrades that apex's **cert stats to null** (the core verified-website-contact value still ships and is billed; only the CT launch signal is honestly missing). CT-log coverage begins ~2018 → `earliestCertDate` is trustworthy for apices first seen since then. Batch ≤100 apices (default 25) to stay well under crt.sh's per-IP capacity.

### Troubleshooting

- **"No apices matched" / empty result** — crt.sh is rate-limiting (502/404). Re-run in a few minutes, lower `concurrency`, or reduce `maxDomains`. The Actor retries automatically but a sustained rate-limit can still zero a run.
- **`earliestCertDate: null` on some leads** — crt.sh could not be reached for that apex within the retry budget; the verified contact is still delivered. Re-run later to recover the launch signal.
- **No contact on a real domain** — the apex's site has no discoverable email/phone/social on its public pages, or it's a parking/holding page. Dropped, not billed.
- **`newlyLaunched: false` on an old domain** — expected; the apex's first cert is years old. Set `newlyLaunchedWithinDays` and use `searchQuery` (not explicit `domains`) to surface only day-zero apices.
- **Search query returns huge / times out** — broad patterns like `%.com` are too large for crt.sh. Use narrower patterns (`%.ai`, `%.dev`, a keyword like `saas`).

### Use cases

- **Vendor outreach on day zero:** sell hosting, payments, analytics, dev-tools, agencies to businesses the week they incorporate online.
- **Newly-launched monitoring:** run a `searchQuery` + `newlyLaunchedWithinDays` on a schedule to catch every new business in your niche as it stands up a site.
- **Investor / VC sourcing:** a fresh cert + a verified contact + tech stack = a just-started company worth a look.
- **Competitor watch:** pass an explicit `domains` list to freshness-score + enrich a known market.

### MCP-ready

Designed as an agent tool: *"find newly launched SaaS sites with a verified contact and Stripe detected"* maps directly to `searchQuery` + `newlyLaunchedWithinDays` + the `techStack` field. Clean, normalized, deduped JSON output.

# Actor input Schema

## `domains` (type: `array`):

Optional: explicit domains or URLs to score as day-zero leads (skips CT discovery; one lead per registrable apex). Use this to enrich + freshness-score a known domain list. A URL like `https://anthropic.com` is normalized to its apex.

## `searchQuery` (type: `string`):

Optional: a crt.sh keyword or SQL-LIKE pattern to discover newly-secured apices across the CT log. Examples: `openai` (all cert names containing 'openai'), `%.dev` (all .dev domains), `saas` (keyword). Apex-deduped; known-big infrastructure domains dropped. Pair with `newlyLaunchedWithinDays` to keep only day-zero apices.

## `newlyLaunchedWithinDays` (type: `integer`):

Flag apices whose FIRST TLS certificate (`earliestCertDate`) was issued within the trailing N days as `newlyLaunched` (rolling window, 0 = disabled). In search mode, setting this also PRE-FILTERS to only day-zero apices. Default 30.

## `maxDomains` (type: `integer`):

Cap on registrable apices enriched (after dedupe + filters). crt.sh is per-IP rate-limited -> modest batches stay reliable; raise to surface more day-zero leads.

## `dropKnownBig` (type: `boolean`):

In search mode, drop apices that are known-big infrastructure/parking domains (google.com, shopify.com, cloudflare.com, etc.) — they are not newly-launched businesses. Default true.

## `verifyEmails` (type: `boolean`):

Validate the best contact email's domain against live MX/DNS records.

## `concurrency` (type: `integer`):

Apices/sites processed in parallel (1-6). Lower this if you hit crt.sh or site rate limits.

## `proxyConfiguration` (type: `object`):

Optional. Only needed if you hit IP rate limits; the Actor works without a proxy (keyless crt.sh + public company sites).

## Actor input object example

```json
{
  "domains": [
    "anthropic.com",
    "cursor.com"
  ],
  "searchQuery": "%.ai",
  "newlyLaunchedWithinDays": 30,
  "maxDomains": 25,
  "dropKnownBig": true,
  "verifyEmails": true,
  "concurrency": 3,
  "proxyConfiguration": {}
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [],
    "searchQuery": "",
    "proxyConfiguration": {}
};

// Run the Actor and wait for it to finish
const run = await client.actor("ayeeyee/ct-newly-launched-startup-lead-extractor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": [],
    "searchQuery": "",
    "proxyConfiguration": {},
}

# Run the Actor and wait for it to finish
run = client.actor("ayeeyee/ct-newly-launched-startup-lead-extractor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [],
  "searchQuery": "",
  "proxyConfiguration": {}
}' |
apify call ayeeyee/ct-newly-launched-startup-lead-extractor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,ayeeyee/ct-newly-launched-startup-lead-extractor"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/9brpol6MzqqW0MXnB/builds/NZ7hq0rx05NNlsYEP/openapi.json