{"uid":"cap_DAW8-9yMMLbnyyOmV9moU","slug":"scrapemole-subdomains-via-certificate-transparency-ef6a4a50","name":"ScrapeMole Subdomains via Certificate Transparency","description":"Pay-per-call domain intelligence for agents: live DNS records (DoH), WHOIS/RDAP registration data (registrar, dates, status, nameservers; no personal data), bulk domain availability (10 names per call) an email security audit (SPF, DKIM, DMARC, MTA-STS, BIMI) with a grade, a live SSL/TLS certificate check and subdomains from Certificate Transparency logs (crt.sh). USDC via x402; failed calls are never charged.\n\nPayments: x402 v2, scheme \"exact\", USDC on Base (eip155:8453). The payment is verified before the work and settled only when the response is 200. Terms: https://domains.scrapemole.workers.dev/terms","url":"https://domains.scrapemole.workers.dev/v1/subdomains?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"limit":{"type":"string","default":"1000","description":"Max names returned (1-5000)."},"domain":{"type":"string","examples":["example.com"],"description":"Registrable domain, e.g. example.com."}},"additionalProperties":false}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"names":[{"name":"*.example.com","issuer":"C=US, O=DigiCert Inc, CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1","wildcard":true,"firstSeen":"2026-01-15T00:00:00","lastExpiry":"2027-01-15T23:59:59"},{"name":"www.example.com","issuer":"C=US, O=DigiCert Inc, CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1","wildcard":false,"firstSeen":"2026-01-15T00:00:00","lastExpiry":"2027-01-15T23:59:59"}],"total":3,"domain":"example.com","source":"crt.sh","partial":false,"truncated":false,"attribution":"Certificate Transparency data via crt.sh (Sectigo)"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_eQYhOf60wlYpRwfhU5Q0o","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Retrieves subdomains for a given domain by querying Certificate Transparency logs via crt.sh, returning subdomain names, issuers, wildcard status, and certificate date ranges.","exampleAgentPrompt":"Can you pull all subdomains that have appeared in Certificate Transparency logs for stripe.com — up to 500 results — so I can see what subdomains they've exposed publicly?","exampleUseCases":[{"title":"Security audit subdomain exposure","prompt":"Give me a full list of subdomains for acmecorp.com that have ever appeared in certificate transparency logs — I want to see any wildcard entries too, so I can assess our attack surface."},{"title":"Competitor infrastructure reconnaissance","prompt":"What subdomains does shopify.com have based on Certificate Transparency logs? Show me up to 2000 results so I can understand how their infrastructure is organized."},{"title":"Pre-acquisition domain due diligence","prompt":"We're considering acquiring a startup at startup.io — can you pull their subdomains from CT logs so I can see how many services they're running and when certificates were last renewed?"}],"resultDescription":"A JSON object containing an array of subdomain entries (each with name, issuer, wildcard boolean, firstSeen, and lastExpiry), plus total count, queried domain, source (crt.sh), and flags indicating whether results are partial or truncated. Attribution to Sectigo Certificate Transparency is included.","failureModes":["Domain not found in CT logs returns empty names array with total 0","Invalid domain format may cause request rejection","Limit parameter out of range (not 1-5000) causes validation error","Payment failure (insufficient USDC balance) results in 402 response with no charge","Partial results possible for domains with very large CT log histories (partial flag set true)","Network/upstream crt.sh unavailability may cause timeout or error response"],"whenToPreferThis":"Choose this endpoint when you need passive, read-only subdomain discovery sourced from publicly available Certificate Transparency logs without active DNS scanning. It is ideal for security audits, reconnaissance, and infrastructure mapping where you want historically observed subdomains with certificate metadata (issuer, expiry). Prefer this over active DNS enumeration tools when stealth or read-only access is required, and over manual crt.sh queries when you need structured, machine-readable output with up to 5000 results per call at a fixed $0.003 USDC per-call cost with no charge on failure.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T12:42:40.149Z","isFirstParty":false,"canonicalSlug":"scrapemole-subdomains-via-certificate-transparency-ef6a4a50"}