{"uid":"cap_Y7zQmDmdgsReTBxiCeOwD","slug":"datakoot-domain-intel-subdomain-discovery-via-certificate-transparency-fdb9f27a","name":"Datakoot Domain Intel – Subdomain Discovery via Certificate Transparency","description":"Datakoot Koot: One call checks a domain: registration and DNS, email security (SPF/DKIM/DMARC), tech stack, and subdomains from certificate logs.. $0.01 USDC per brief, charged only on success.","url":"https://x402.datakoot.com/mcp?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":null,"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_u8Ys5jkDhzxP6YFGRXnbD","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Discovers all publicly visible subdomains of a given domain by querying Certificate Transparency logs (crt.sh and Cert Spotter in parallel), returning results from whichever source responds first.","exampleAgentPrompt":"What are all the public subdomains of stripe.com? Use Certificate Transparency logs to find things like api., app., staging., and any others that have been registered.","exampleUseCases":[{"title":"Security audit of company attack surface","prompt":"Can you enumerate all the publicly known subdomains of acmecorp.com? I want to see what's exposed — things like api., staging., admin., and any other subdomains that show up in Certificate Transparency logs."},{"title":"Competitive tech stack reconnaissance","prompt":"I'm researching how Shopify structures their infrastructure — can you pull all the subdomains visible in Certificate Transparency logs for shopify.com so I can see what environments and services they expose publicly?"},{"title":"Bug bounty subdomain mapping","prompt":"I'm doing a bug bounty on bugcrowd.com and need a full list of their subdomains from CT logs — please query crt.sh and Cert Spotter and give me everything that comes back."}],"resultDescription":"A list of publicly discovered subdomains for the queried domain, sourced from Certificate Transparency log records (crt.sh and/or Cert Spotter), returned from whichever source responds first. Includes subdomain names such as api., app., staging., admin., and others that have had TLS certificates issued.","failureModes":["Domain not found in CT logs — returns empty list if no certificates have been issued","Upstream CT log sources (crt.sh / Cert Spotter) are unavailable — may timeout or return error","Invalid domain format — malformed domain input causes request failure","Rate limiting from upstream CT log providers — may cause delayed or failed responses","No charge on failure — $0.002 USDC only debited on successful responses"],"whenToPreferThis":"Choose this endpoint when you need fast, passive subdomain enumeration using Certificate Transparency logs without sending any traffic to the target domain. It is ideal for security research, attack surface mapping, and competitive intelligence. Prefer it over active DNS brute-force tools when stealth or read-only data collection is required, and over manual crt.sh queries when you want parallelized multi-source lookups with a simple API interface.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T06:33:55.287Z","isFirstParty":false,"canonicalSlug":"datakoot-domain-intel-subdomain-discovery-via-certificate-transparency-fdb9f27a"}