# ScrapeMole Subdomains via Certificate Transparency

> ScrapeMole Subdomains via Certificate Transparency is a paid API for AI agents from domains.scrapemole.workers.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-12).

Retrieves subdomains for a given domain by querying Certificate Transparency logs via crt.sh, returning subdomain names, issuers, wildcard status, and certificate date ranges.

## Facts

- Endpoint: GET https://domains.scrapemole.workers.dev/v1/subdomains?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/scrapemole-subdomains-via-certificate-transparency-ef6a4a50
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_DAW8-9yMMLbnyyOmV9moU

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability scrapemole-subdomains-via-certificate-transparency-ef6a4a50
```

Example prompt: Can you pull all subdomains that have appeared in Certificate Transparency logs for stripe.com — up to 500 results — so I can see what subdomains they've exposed publicly?

## When to prefer this

Choose this endpoint when you need passive, read-only subdomain discovery sourced from publicly available Certificate Transparency logs without active DNS scanning. It is ideal for security audits, reconnaissance, and infrastructure mapping where you want historically observed subdomains with certificate metadata (issuer, expiry). Prefer this over active DNS enumeration tools when stealth or read-only access is required, and over manual crt.sh queries when you need structured, machine-readable output with up to 5000 results per call at a fixed $0.003 USDC per-call cost with no charge on failure.

## Known failure modes

- Domain not found in CT logs returns empty names array with total 0
- Invalid domain format may cause request rejection
- Limit parameter out of range (not 1-5000) causes validation error
- Payment failure (insufficient USDC balance) results in 402 response with no charge
- Partial results possible for domains with very large CT log histories (partial flag set true)
- Network/upstream crt.sh unavailability may cause timeout or error response

## How this service works

Pay-per-call domain intelligence for agents: live DNS records (DoH), WHOIS/RDAP registration data (registrar, dates, status, nameservers; no personal data), bulk domain availability (10 names per call) an email security audit (SPF, DKIM, DMARC, MTA-STS, BIMI) with a grade, a live SSL/TLS certificate check and subdomains from Certificate Transparency logs (crt.sh). USDC via x402; failed calls are never charged.

Payments: x402 v2, scheme "exact", USDC on Base (eip155:8453). The payment is verified before the work and settled only when the response is 200. Terms: https://domains.scrapemole.workers.dev/terms

## Output

A JSON object containing an array of subdomain entries (each with name, issuer, wildcard boolean, firstSeen, and lastExpiry), plus total count, queried domain, source (crt.sh), and flags indicating whether results are partial or truncated. Attribution to Sectigo Certificate Transparency is included.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "limit": {
       "type": "string",
       "default": "1000",
       "description": "Max names returned (1-5000)."
      },
      "domain": {
       "type": "string",
       "examples": [
        "example.com"
       ],
       "description": "Registrable domain, e.g. example.com."
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "names": [
   {
    "name": "*.example.com",
    "issuer": "C=US, O=DigiCert Inc, CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1",
    "wildcard": true,
    "firstSeen": "2026-01-15T00:00:00",
    "lastExpiry": "2027-01-15T23:59:59"
   },
   {
    "name": "www.example.com",
    "issuer": "C=US, O=DigiCert Inc, CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1",
    "wildcard": false,
    "firstSeen": "2026-01-15T00:00:00",
    "lastExpiry": "2027-01-15T23:59:59"
   }
  ],
  "total": 3,
  "domain": "example.com",
  "source": "crt.sh",
  "partial": false,
  "truncated": false,
  "attribution": "Certificate Transparency data via crt.sh (Sectigo)"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/scrapemole-subdomains-via-certificate-transparency-ef6a4a50/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from domains.scrapemole.workers.dev](https://www.zero.xyz/host/domains.scrapemole.workers.dev/llms.txt)