Pricing

from $1.25 / 1,000 hostnames

Subdomain Finder: Certificate Transparency

Enumerate every subdomain of a domain from public Certificate Transparency logs. No brute-force wordlist and no DNS hammering, because every TLS certificate is logged, so the hosts are already public record. Deduplicated to one row per hostname, with first seen, issuing CA and current validity.

Pricing

from $1.25 / 1,000 hostnames

Rating

0.0

(0)

Developer

Daniel Meshulam

Actor stats

Bookmarked

Total users

Monthly active users

a day ago

Last modified

Map every subdomain a company exposes

Subdomain Finder

happitap/subdomain-finder

Subdomain Finder is a high-speed intelligence tool that uncovers subdomains for any target domain using Certificate Transparency (CT) logs. Unlike traditional brute-force tools, it requires no heavy traffic and provides results in seconds.

HappiTap

Subdomain Finder — Certificate Transparency (crt.sh)

bgfc97/crtsh-subdomain-finder

Discover subdomains of any domain from public Certificate Transparency logs (crt.sh). Attack-surface mapping and recon with first/last-seen dates. No key, no proxy.

Bruno

SSL Certificate Transparency Scraper (crt.sh)

chrisp1211/certificate-search-scraper-max

Scrape SSL/TLS certificate transparency logs from crt.sh for any domain. Great for security audits and subdomain discovery. Returns common name, subdomains (SANs), issuer and validity. Pay per certificate; empty runs free.

Christian Pichichero

SSL Certificate & Subdomain Finder for Any Website

scrapemint/ssl-subdomain-finder

Find all the subdomains of any website and check its SSL certificates. Paste a domain and get every subdomain seen in public certificate records, plus the certificate issuer, valid dates and days until expiry. Great for security checks and finding forgotten sites. No API key needed.

Ken M

5.0

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Logiover

Subdomain Finder - Discover Every Subdomain Of A Domain

thirdwatch/subdomain-finder

Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.

Thirdwatch

crt.sh Certificate Transparency Scraper

parseforge/crtsh-certificate-transparency-scraper

Search the crt.sh certificate transparency logs for any domain you control and surface the hosts behind it. Each record carries the common name, every subject alternative name, the issuing authority, serial number, and validity window. Built for attack surface mapping and asset inventory.

ParseForge

Certificate Transparency Monitor — AI Agent Recon API

logiover/certificate-transparency-monitor

Keyless certificate transparency intelligence for AI agents: crt.sh CT logs. Track new TLS certs for any domain, discover subdomains via wildcard, batch domains. Issuer, validity, SAN domains and serial per row. No API key, no browser.

Logiover

Real Subdomain Finder

onescales/real-subdomain-finder

Discover every subdomain for any domain. Queries 40+ OSINT sources including cert transparency, DNS archives & web scanners. Results enriched with DNS validation, HTTP probing, and subdomain takeover detection. Simple Subdomain Lookup that works!

One Scales

5.0

Sublist3r Subdomain Finder & Takeover Scanner

datacach/sublist3r-subdomain-finder

Subdomain enumeration from passive OSINT sources — certificate transparency logs, passive DNS and public APIs — with optional active HTTP/TLS fingerprinting of every live host, scored for takeover risk. Run it only against domains you are authorized to assess.