Certificate Transparency Subdomain Lookup (crt.sh)

Use this endpoint when you need passive subdomain enumeration without active scanning — it relies purely on public certificate transparency logs and leaves no footprint on the target. Prefer this over DNS brute-forcing when stealth or speed matters, or when you want historical subdomain data from issued certificates.

• Domain not found or no CT records — returns empty result
• Invalid domain format — may return error or empty response
• Rate limiting by upstream crt.sh — may result in timeout or error
• Very large domains (e.g. google.com) may return extremely large or truncated result sets
• Network timeout if crt.sh is slow to respond