Pricing

from $3.00 / 1,000 certificate fetcheds

Attack Surface Intelligence — Certificate Transparency

Turn Certificate Transparency logs into attack-surface intelligence. Find new subdomains, exposed admin/VPN/DevOps services, brand-abuse look-alikes, and infrastructure drift, each with a risk score, recommended action, and investigation priority. Findings and executive summary included.

Pricing

from $3.00 / 1,000 certificate fetcheds

Rating

0.0

(0)

Developer

Ryan Clinton

Actor stats

Bookmarked

Total users

Monthly active users

6 days ago

Last modified

Categories

Developer tools

Automation

Profile (choose your goal)

profile

Optional

One-click job bundle that pre-configures the actor. 'external-attack-surface' (medium+ risk review), 'phishing-monitor' (phishing mode + hunt themes), 'certificate-governance' (expiry/rotation/issuer focus), 'recon' (exposed-services-first, full detail), 'executive-report' (high-risk hosts + findings + board summary). Leave blank to configure manually. Explicit settings below always override the profile.

Type:string

Options:

external-attack-surfacephishing-monitorcertificate-governancereconexecutive-report

Domain

domain

Required

Domain to search for certificates (e.g., 'example.com'). Use '%.example.com' for manual wildcard subdomain search, or '%brand%' to hunt look-alike phishing domains.

Type:string

Default:crt.sh

Domains (portfolio mode)

domains

Optional

Optional. Scan several domains in one run and get an organization-wide attack-surface rollup. Overrides the single Domain field when set. Capped at 25 domains; each domain is scanned independently (one bad domain won't sink the run).

Type:array

Max. items:25

Include Expired Certificates

includeExpired

Optional

Include certificates that have already expired.

Type:boolean

Default:true

Include Subdomains

includeSubdomains

Optional

Automatically prepend % wildcard to search for all subdomains of the domain. Disable for faster, more reliable queries on large domains.

Type:boolean

Default:false

Deduplicate Subdomains

deduplicateSubdomains

Optional

When enabled, returns unique subdomains with first/last seen dates and per-subdomain risk scoring. When disabled, returns individual scored certificate records.

Type:boolean

Default:true

Max Results

maxResults

Optional

Maximum number of results to return per domain.

Type:integer

Minimum:1

Maximum:5000

Default:100

Analysis Mode

analysisMode

Optional

Re-prioritizes the same CT data for a security persona. 'attack-surface' (default, balanced); 'recon' (boosts admin/VPN/internal tooling exposure); 'phishing' (boosts suspicion + brand-abuse signals); 'certificate-audit' (boosts expiry + rotation + issuer changes); 'compliance' (boosts expired certs, issuer changes, wildcards).

Type:string

Default:attack-surface

Options:

attack-surfacereconphishingcertificate-auditcompliance

Brand Name (phishing / typosquat detection)

brandName

Optional

Optional. A brand term (e.g. 'examplebank'). Each hostname is scored for brand-abuse risk — look-alike hostnames that contain your brand on a DIFFERENT registrable domain (e.g. examplebank-login.com) are flagged. Pair with a '%brand%' query to hunt phishing domains across CT logs.

Type:string

Threat-Hunting Mode

huntMode

Optional

When enabled, every hostname is tagged with a phishing huntTheme (credential / payment / identity / remote-access) and themed findings are emitted — for hunting brand-abuse and phishing infrastructure across a broad '%brand%' query without knowing CT querying.

Type:boolean

Default:false

Watchlist Name

watchlistName

Optional

Optional. Name a watchlist to persist state across runs. On the next scheduled run, every hostname is flagged with a changeType (new-host / suspicious-new-host / issuer-changed / certificate-rotation / wildcard-added / wildcard-removed / exposure-increased / unchanged), plus run-level trend records. First run flags everything as new-host; drift becomes meaningful from run 2 onward. Leave blank for a stateless one-off scan.

Type:string

Minimum Risk Level

minRiskLevel

Optional

Drop records below this risk level from the output (and from billing). Use 'medium' or 'high' to surface only the subdomains worth investigating on large domains.

Type:string

Default:minimal

Options:

minimallowmediumhighcritical

Output Profile

outputProfile

Optional

Field verbosity per record. 'minimal' returns only the decision essentials (host, risk, recommended action, changeType, brandAbuseRisk); 'standard' (default) omits the boolean suspicion-signal breakdown; 'full' returns everything.

Type:string

Default:standard

Options:

minimalstandardfull

crt.sh Certificate Transparency Scraper

parseforge/crtsh-certificate-transparency-scraper

Search the crt.sh certificate transparency logs for any domain you control and surface the hosts behind it. Each record carries the common name, every subject alternative name, the issuing authority, serial number, and validity window. Built for attack surface mapping and asset inventory.

ParseForge

Certificate Transparency Subdomain Search (crt.sh alternative)

advx/ct-domain-lookup

Find subdomains and TLS certificates for any domain from Certificate Transparency logs. A fast, working crt.sh alternative for subdomain enumeration, recon and attack-surface mapping. Returns unique hostnames with first/last seen and issuers, or raw certificates.

Sevastian Z

Cyber Attack Surface — DNS, SSL & CVE Exposure

ryanclinton/cyber-attack-surface-report

Comprehensive external attack surface report that maps any domain's infrastructure, vulnerabilities, and exposure using 11 sub-actors in parallel.

Ryan Clinton

Entity Attack Surface MCP Server

ryanclinton/entity-attack-surface-mcp

Corporate cyber exposure intelligence via the Model Context Protocol. This MCP server orchestrates 11 data sources to discover and score an organization's digital attack surface -- from DNS and SSL infrastructure to technology vulnerabilities and CISA Known Exploited Vulnerabilities.

Ryan Clinton

🔍 Subdomain Finder & CT Log Scraper

taroyamada/subdomain-finder

Map website architectures by extracting subdomains from public Certificate Transparency logs to find unlinked staging sites.

naoki anzai

SSL Certificate Checker - Bulk Expiry Monitor

pink_comic/ssl-certificate-checker

SSL certificate checker for certificate issuer, expiration dates, chain validation, and protocol details. Monitor certificate health for any domain. For security audits, compliance, and uptime monitoring. No API key required.

Ava Torres

Domain OSINT Recon

prooflio/domain-osint-recon

Aggregates WHOIS, DNS records, certificate-transparency subdomains and PTR records for a domain into one structured report.

Prooflio AI

5.0

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

Andok

SSL Certificate Checker

rationalistic_counsel/ssl-certificate-checker

J N

Attack Surface Recon: Subdomain Discovery + HTTP Fingerprint

advx/attack-surface-recon

Map a domain's external attack surface. Passive subdomain enumeration with subfinder, HTTP fingerprint with httpx: status, title, server, technology stack, TLS issuer and IP. One dataset row per responding host. For recon, asset discovery and security audits.

Sevastian Z