# Domain Attack Surface — SSL + CT Logs + Breach History (`gochujang/domain-attack-surface-suite`) Actor

Complete external security posture for any domain in one run: SSL certificate expiry and chain, subdomain discovery via Certificate Transparency logs (crt.sh), and data breach history from Have I Been Pwned. No API key required for core checks.

- **URL**: https://apify.com/gochujang/domain-attack-surface-suite.md
- **Developed by:** [Hojun Lee](https://apify.com/gochujang) (community)
- **Categories:** Developer tools
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per usage

This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-usage

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

### What does Domain Attack Surface Suite do?

**Domain Attack Surface Suite** is an all-in-one **domain attack surface scanner** that runs SSL certificate inspection, passive subdomain enumeration via Certificate Transparency logs, and data breach history checks in a single automated API call. It is purpose-built as an **OSINT reconnaissance tool** for security teams, giving you a complete **cybersecurity domain audit** without juggling three separate services. Results arrive as structured JSON with auto-generated risk flags, ready for SIEM ingestion, dashboards, or Slack alerts.

### Why use Domain Attack Surface Suite?

**Security teams and businesses** rely on this actor because it collapses three time-consuming manual checks into one API call with actionable risk flags.

- **CISO Quarterly Audits** — Scan your entire domain portfolio overnight. The actor flags `SSL_EXPIRED`, `SSL_EXPIRING_IN_Xd`, and `DOMAIN_BREACHED` so your team focuses on real risks, not spreadsheet management.
- **DevSecOps Pipeline Checks** — Catch expiring certificates and newly discovered subdomains before they appear in a production incident. Run it on a schedule directly from your CI/CD pipeline.
- **Vendor Due Diligence** — Assess a vendor's external security posture before signing contracts. A single API call returns their SSL health, shadow subdomains, and breach exposure.
- **Bug Bounty Reconnaissance** — Passive **subdomain discovery** from Certificate Transparency logs via crt.sh surfaces assets without triggering IDS alerts — the same source professional bug hunters use.
- **M\&A Technical Due Diligence** — Get a rapid security posture snapshot of acquisition targets. Combine breach history with subdomain sprawl to quantify technical debt before close.

### How to use Domain Attack Surface Suite

1. Click **Try for free** on the Apify Store listing.
2. Enter one or more domains in the `domains` field (e.g. `["example.com", "api.example.com"]`).
3. Optionally add your **HIBP API key** (`$4/month`) to enable domain-level breach counts; the free tier still returns the full breach database summary.
4. Adjust `expiryWarningDays` (default 30) and `maxSubdomains` (default 100) if needed.
5. Click **Start**. Each domain takes roughly 10 seconds to analyze.
6. Download results as JSON, CSV, or connect to Zapier / Make for automated alerting.

### Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `domains` | string\[] | Yes | — | Domain names to analyze (e.g. `["example.com"]`) |
| `hibpApiKey` | string | No | — | **HIBP API key** for domain-level breach counts ($4/month at haveibeenpwned.com) |
| `checkSubdomains` | boolean | No | `true` | Enable passive **subdomain enumeration** via CT logs (crt.sh) |
| `expiryWarningDays` | integer | No | `30` | Days threshold to trigger `SSL_EXPIRING_IN_Xd` risk flag |
| `maxSubdomains` | integer | No | `100` | Maximum subdomains returned per domain |

#### Example Input

```json
{
  "domains": ["example.com", "api.example.com"],
  "checkSubdomains": true,
  "expiryWarningDays": 30,
  "maxSubdomains": 100
}
```

### Output

Two record types are pushed to the Apify dataset per run.

#### domain\_analysis record

```json
{
  "_type": "domain_analysis",
  "domain": "example.com",
  "analyzed_at": "2026-06-01T10:00:00+00:00",
  "ssl_ok": true,
  "ssl_expiry": "2026-09-15T12:00:00+00:00",
  "ssl_days_left": 106,
  "ssl_expired": false,
  "ssl_expiring_soon": false,
  "ssl_issuer_cn": "Let's Encrypt Authority X3",
  "ssl_san": ["example.com", "www.example.com"],
  "subdomains_found": 47,
  "subdomain_sample": ["www.example.com", "mail.example.com", "staging.example.com"],
  "risk_flags": []
}
```

#### subdomain record

```json
{
  "_type": "subdomain",
  "parent_domain": "example.com",
  "subdomain": "staging.example.com",
  "issuer": "Let's Encrypt Authority X3",
  "not_after": "2026-08-20T00:00:00",
  "logged_at": "2026-03-10T14:22:01.000Z"
}
```

### Data fields

| Field | Description |
|---|---|
| `ssl_ok` | `true` if TLS handshake succeeded and certificate is valid |
| `ssl_days_left` | Days until certificate expiry (negative = already expired) |
| `ssl_expired` | `true` if certificate is currently expired |
| `ssl_expiring_soon` | `true` if expiry is within `expiryWarningDays` |
| `ssl_issuer_cn` | Certificate issuer common name (e.g. Let's Encrypt) |
| `ssl_san` | Subject Alternative Names on the certificate |
| `subdomains_found` | Total unique subdomains discovered in CT logs |
| `subdomain_sample` | Up to 5 representative subdomains |
| `risk_flags` | Auto-generated flags: `SSL_EXPIRED`, `SSL_EXPIRING_IN_Xd`, `DOMAIN_BREACHED`, `SSL_ERROR` |

### Cost estimation

| Event | Price |
|---|---|
| Actor start | $0.001 (flat, one-time) |
| Per domain analyzed | $0.01 |
| Per subdomain discovered | $0.001 |

**Example:** 10 domains × 40 subdomains average = $0.001 + (10 × $0.01) + (400 × $0.001) = **$0.50 total**

Compare to manual alternatives:

| Approach | Time | Automation |
|---|---|---|
| SSL Labs + crt.sh + HIBP manually | 15–30 min per domain | None |
| This actor | ~10 sec per domain | Full API / schedule |

### FAQ

**Do I need an API key to get started?**
No. SSL certificate checks and CT log subdomain enumeration are completely free with no API key. A **HIBP API key** ($4/month) is only required for domain-level breach counts showing affected account numbers and breach names.

**Does this perform active scanning or port scanning?**
No. All checks are passive. SSL data comes from a direct TLS handshake, subdomains from the public crt.sh Certificate Transparency log aggregator, and breach data from the Have I Been Pwned public API. No active port scanning or vulnerability probing is performed.

**How do I automate regular domain monitoring?**
Use Apify's built-in **scheduler** to run this actor daily or weekly on your domain list. Combine it with Apify's **webhook integrations** to push risk flag alerts to Slack, PagerDuty, or your SIEM automatically.

***

*Data sources: SSL via Python `ssl` stdlib (direct TLS handshake), subdomains via [crt.sh](https://crt.sh) Certificate Transparency aggregator, breach data via [Have I Been Pwned](https://haveibeenpwned.com). This actor performs passive reconnaissance only and does not modify any systems.*

***

### Related actors

- [Domain Breach Checker](https://apify.com/gochujang/domain-breach-checker) — Deep HIBP breach lookup for all email addresses found on a domain
- [npm Package Security Scanner](https://apify.com/gochujang/npm-package-security-scanner) — Supply chain risk for JavaScript dependencies used by web assets on your domain
- [DeFi Hack Monitor](https://apify.com/gochujang/defi-hack-monitor) — Protocol-level exploit tracking to pair with domain security auditing for crypto projects

### Feedback

If this actor powers your security research, a review helps others find it: [Leave a review on Apify Store](https://apify.com/gochujang/domain-attack-surface-suite#reviews)

# Actor input Schema

## `domains` (type: `array`):

Domain names to analyze (e.g. \['example.com', 'api.example.com'])

## `hibpApiKey` (type: `string`):

Have I Been Pwned API key for domain-level breach checking ($4/month at haveibeenpwned.com). Without key, returns breach database summary.

## `checkSubdomains` (type: `boolean`):

Query crt.sh Certificate Transparency logs to discover subdomains

## `expiryWarningDays` (type: `integer`):

Flag SSL certificates expiring within this many days

## `maxSubdomains` (type: `integer`):

Maximum unique subdomains to return from CT logs

## Actor input object example

```json
{
  "checkSubdomains": true,
  "expiryWarningDays": 30,
  "maxSubdomains": 100
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("gochujang/domain-attack-surface-suite").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("gochujang/domain-attack-surface-suite").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call gochujang/domain-attack-surface-suite --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,gochujang/domain-attack-surface-suite"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/moJwptIOAVs9ALjn8/builds/VYSHDj2wZaOyfRQiq/openapi.json