Passive subdomain enumeration

Subdomains, already found.

A local index built from certificate transparency logs, registry zone data, and public crawls. Give it an apex and the names come back oldest known first, with first-seen dates where the source provides them. Nothing is fetched from an upstream source while you wait.

Hostnames on file

reading the index

Apexes covered

distinct registrable domains

CT logs feeding it

counted from ingest evidence

Last write to the index

from the ingest run log

Using it

One call, no key.

One apex in, hostnames out, from a shell or from anything that speaks HTTP. There is no key to request and no account to make. An apex with nothing on file answers 200 with an empty body, so a miss is cheap to handle.

curl -s "$SUBFINDER/v1/search?apex=example.com"

curl -s "$SUBFINDER/v1/search?apex=example.com&format=json&dates=1" \
  | jq -r '.[] | "\(.first_seen // "undated")\t\(.sub)"'

What the index is built from

The Chrome and Apple log lists name the logs worth reading. A poller walks ct/v1/get-entries on every usable log in both programs, and the Geomys archive backfills logs that have since retired. Zone data from IANA, CISA, and the registries that publish openly, plus Common Crawl, fill in apexes that certificates alone would miss.

Each name keeps three fields. Hostname, apex, and the earliest date any source saw it. No certificate bodies, no serial numbers, no issuer chains.

Reading it without a browser

Search

GET /v1/search?apex=example.com

One hostname per line. Add &format=json for an array, &dates=1 to attach each first-seen date. Rows come back oldest first, undated names last.

Index size

GET /v1/stats

Counts for the whole index and the timestamp of the last ingest run. It costs nothing against the search allowance, which is what lets the counter above keep itself current.

Allowance

X-RateLimit-Remaining

1000 successful reads per IP per UTC day, shared with the MCP endpoint. Every response carries the limit, what is left, and the reset time. A spent allowance returns 429 with Retry-After.

MCP

POST /mcp

One streamable HTTP tool called search. Pass an apex, get an array of hostnames. Same allowance as the HTTP route, same refusal to probe.