{"uid":"cap_cyHnQjpU59lL9dukG-laJ","slug":"subdomain-finder-via-certificate-transparency-4ec155cd","name":"Subdomain Finder via Certificate Transparency","description":"Subdomain finder from certificate-transparency logs: every hostname under a domain that has appeared in public TLS certificates (crt.sh), deduplicated and sorted, up to 500. Attack-surface mapping, asset discovery and competitor research. $0.01 per domain.","url":"https://intel.rallylive.ca/subdomains","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","properties":{}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_6PeD-aivFThj0YseoJJq4","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns all subdomains of a given domain discovered in public TLS certificate transparency logs (crt.sh), deduplicated and sorted, up to 500 results.","exampleAgentPrompt":"Can you pull all the subdomains you can find for stripe.com using certificate transparency logs? I want to see everything that's shown up in public TLS certs.","exampleUseCases":[{"title":"Attack surface mapping for pentest","prompt":"I'm doing a security assessment on acme.com — can you enumerate all the subdomains that have appeared in public TLS certificates so I can map out their attack surface?"},{"title":"Competitor infrastructure research","prompt":"Pull all subdomains you can find for shopify.com from certificate transparency logs — I want to understand what infrastructure and services they've exposed publicly."},{"title":"Forgotten asset discovery","prompt":"Can you look up all subdomains for our domain mybrand.io using certificate logs? We think there might be old staging or dev environments still exposed that we've forgotten about."}],"resultDescription":"A deduplicated, sorted list of up to 500 hostnames (subdomains) that have appeared in public TLS certificate transparency logs for the given domain, sourced from crt.sh.","failureModes":["Domain not found or never issued a TLS certificate returns an empty list","Malformed domain input may return an error","Rate limiting or payment failure returns a 402 response","Results capped at 500 entries; very large domains may be truncated","Wildcard certificate entries (e.g. *.example.com) may appear in results"],"whenToPreferThis":"Choose this endpoint when you need passive, non-intrusive subdomain enumeration based purely on public certificate transparency logs. It is ideal for OSINT, asset discovery, and attack-surface mapping without sending any traffic to the target. Prefer it over active DNS brute-force tools when stealth or legality is a concern, or when you need a quick, cheap ($0.01) snapshot of a domain's publicly known subdomains.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T13:12:27.223Z","isFirstParty":false}