Domain Attack Surface & Subdomain Scanner

Domain Attack Surface & Subdomain Scanner maps a domain's external footprint from open sources: it finds subdomains from Certificate Transparency logs, resolves each to its IP address, and inspects the live SSL/TLS certificate (issuer, expiry date, days remaining) — one clean row per host. No login, no API key, no personal data. It's a fast subdomain finder and attack-surface scanner in one.

What can the Domain Attack Surface Scanner do?

• Find all subdomains of a domain using two Certificate Transparency sources (certSpotter + crt.sh), automatically deduplicated.
• Check which subdomains are live by resolving DNS and reporting the IP.
• Audit SSL certificates — see the issuer, expiry date, and days-until-expiry for every live host, so you can catch certificates about to expire.
• Monitor your external attack surface — run it on a schedule and diff the results to catch new or forgotten subdomains before someone else does.
• Do recon on any domain you're authorized to assess — a lightweight alternative to heavyweight security suites.

What data does the subdomain scanner return?

Field	Type	Example
domain	string	example.com
subdomain	string	www.example.com
ip	string	172.66.147.243
status	string	live / no-dns
ssl_issuer	string	SSL Corporation
ssl_expires	string	Oct 27 22:17:21 2026 GMT
ssl_days_left	string	44
source	string	certspotter / crt.sh / both

Domains and infrastructure, not people. This scanner maps hostnames, IPs, and certificates — public technical facts. It collects no personal data.

How much does the attack surface scanner cost?

Pay-per-result — you're charged only per host returned. Runs are cheap because it uses lightweight HTTP + DNS/TLS lookups (no heavy browser, no proxies), so there's no separate compute or proxy bill.

Tier	Price	Best for
Free trial	first small batch free	scanning your own domain
Pay-as-you-go	low per-result	one-off recon
Scheduled monitor	per-event	daily attack-surface change alerts

How do I scan a domain? (step by step)

1. Enter one or more domains (e.g. example.com).
2. Set max hosts per domain.
3. Run it. Download the results as JSON, CSV, or Excel, or pull them via the Apify API.
4. (Optional) Schedule it and diff the dataset to get alerted on new subdomains or soon-to-expire certificates.

Input

{ "domains": ["example.com"], "max_hosts": 100 }

Output (one row per subdomain)

{
  "domain": "example.com",
  "subdomain": "www.example.com",
  "ip": "172.66.147.243",
  "status": "live",
  "ssl_issuer": "SSL Corporation",
  "ssl_expires": "Oct 27 22:17:21 2026 GMT",
  "ssl_days_left": "44",
  "source": "both"
}

Who uses a subdomain & attack-surface scanner?

• Security teams & pentesters — map an authorized target's external footprint fast.
• IT / DevOps — inventory your own subdomains and catch expiring SSL certificates before they cause outages.
• Bug-bounty hunters — quick recon and subdomain discovery on in-scope programs.
• Domain owners — find forgotten or shadow subdomains you didn't know were exposed.

FAQ

Do I need an API key? No. It reads public Certificate Transparency logs, DNS, and TLS handshakes — no account or key.

Which subdomains does it find? Anything that has appeared in a public SSL certificate for the domain (via certSpotter and crt.sh). It won't find subdomains that never had a certificate, but CT coverage is broad and it merges two sources for completeness.

Is this legal? It queries only public infrastructure data (certificate logs, DNS, public TLS certificates) — no logins, no private systems, no personal data. Only scan domains you own or are authorized to assess.

Can it alert me to expiring certificates or new subdomains? Yes — schedule it and compare runs; ssl_days_left and the subdomain list make change-detection straightforward.

What formats can I export? JSON, CSV, Excel, plus the Apify API and integrations.