# CT Subdomain Enumeration

> CT Subdomain Enumeration is a paid API for AI agents from anibalb.duckdns.org, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-31).

Enumerates subdomains for a given domain by querying Certificate Transparency logs, returning discovered subdomains along with their TLS certificate issuers.

## Facts

- Endpoint: GET https://anibalb.duckdns.org/x402/ct-subdomain-enum?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ct-subdomain-enumeration-2e9a72cd
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_B5l9Z8vu3797HBPcFVwOu

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ct-subdomain-enumeration-2e9a72cd
```

Example prompt: Can you enumerate all the subdomains for example.com using certificate transparency logs and show me each subdomain along with which certificate authority issued their TLS cert?

## When to prefer this

Choose this endpoint when you need passive, non-intrusive subdomain discovery based on Certificate Transparency log data — it requires no active scanning of the target domain and is suitable for recon, security audits, or attack surface mapping. Prefer this over active DNS brute-force tools when stealth or read-only access is required, and when you want to find subdomains that have had TLS certificates issued rather than guessing names.

## Known failure modes

- Domain not found in CT logs returns empty subdomains array
- Invalid domain format may return an error or empty result
- CT log data may be incomplete or delayed for very new domains
- Rate limiting or payment failure returns 402 Payment Required
- Wildcard certificates may obscure individual subdomains

## How this service works

Public data and utility APIs paid per call in USDC on Base (x402). No accounts, no API keys. 174 routes: crypto/equity data, onchain reads, DNS/email/security intel, geo/weather, x402 payment diagnostics, dev utilities and more.

## Output

Returns a JSON object containing the queried domain and an array of discovered subdomains, each with the subdomain's full hostname and the name of the TLS certificate issuer (e.g. Let's Encrypt, DigiCert) that issued a certificate for it.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "domain": "example.com",
  "subdomains": [
   {
    "name": "www.example.com",
    "issuer": "Let's Encrypt"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ct-subdomain-enumeration-2e9a72cd/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from anibalb.duckdns.org](https://www.zero.xyz/host/anibalb.duckdns.org/llms.txt)