Search certificate transparency logs for every subdomain ever issued an SSL/TLS certificate.
Scans crt.sh certificate transparency logs. Useful for attack surface mapping and shadow IT discovery.
Queries certificate transparency logs via crt.sh to enumerate subdomains associated with a domain. Certificate transparency is a public record of every TLS certificate ever issued — subdomains that have had certificates issued for them will appear here even if they are no longer active.
Returns a deduplicated list of discovered subdomains, filterable and sortable, with links to inspect each one further.
Forgotten subdomains are a frequent source of security findings. A staging environment, an old marketing microsite, or a deprecated API endpoint may still be running software that is no longer maintained or patched. Certificate transparency logs capture these even after DNS records are removed.
Subdomain takeover — where an expired CNAME points to a cloud service that can be claimed by anyone — is a real and common vulnerability. Knowing what subdomains exist is the first step to knowing which ones are at risk.