# Subdomain Enumeration via Public Sources

> Subdomain Enumeration via Public Sources is a paid API for AI agents from k2so.wrong.systems, paid per call via x402, $0.03/call, status down (last checked 2026-09-15).

Passively enumerates subdomains for a given domain using public OSINT sources via subfinder.

## Facts

- Endpoint: GET https://k2so.wrong.systems/api/services/subdomain-enumeration
- Price: $0.03/call
- Payment: x402
- Status: down
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/subdomain-enumeration-via-public-sources-d4b418e2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_fLU8EHuBUMjAVqSBMH_PD

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability subdomain-enumeration-via-public-sources-d4b418e2
```

Example prompt: Can you find all the subdomains for acme-corp.com using passive public sources — I want to see what's exposed without doing any active scanning?

## When to prefer this

Use this endpoint when you need passive, non-intrusive subdomain discovery using aggregated public OSINT sources (certificate transparency, DNS, search engines) without touching the target's infrastructure. Prefer over active scanners when stealth is required or active probing is restricted. Best suited for security assessments, attack surface mapping, and recon workflows that must avoid generating traffic on the target network.

## Known failure modes

- Domain not found or no results available — returns empty result set
- Invalid domain format — query rejected
- Payment not completed — 402 response requiring USDC payment
- Rate limiting or upstream source unavailability — partial results or timeout
- Private/unlisted domains with no public footprint — zero subdomains returned

## How this service works

Passive subdomain enumeration for a domain via public sources (subfinder).

## Output

A JSON response containing a list of discovered subdomains for the queried domain, sourced passively from public data (e.g. certificate transparency logs, DNS records, search engines). Includes ok/paid status flags, service/provider metadata, and the enumerated subdomain results.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "meta": {
       "enum": [
        "0",
        "1"
       ],
       "type": "string",
       "description": "Set to 1 for free metadata JSON (no payment required)"
      },
      "domain": {
       "type": "string",
       "description": "Composite input parameter"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "title": "Subdomain Enumeration paid response",
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "required": [
      "ok",
      "paid",
      "service",
      "provider",
      "result"
     ],
     "properties": {
      "ok": {
       "type": "boolean"
      },
      "paid": {
       "type": "boolean"
      },
      "result": {
       "type": "object",
       "required": [
        "ok",
        "service"
       ],
       "properties": {
        "ok": {
         "type": "boolean",
         "description": "Handler success"
        },
        "score": {
         "type": "number"
        },
        "service": {
         "type": "string",
         "description": "Service slug"
        },
        "summary": {
         "type": "string"
        },
        "evidence": {
         "type": "object"
        },
        "strengths": {
         "type": "array",
         "items": {
          "type": "string"
         }
        },
        "confidence": {
         "type": "string"
        },
        "generatedAt": {
         "type": "string",
         "description": "ISO-8601 timestamp"
        },
        "riskFactors": {
         "type": "array",
         "items": {
          "type": "string"
         }
        }
       }
      },
      "payment": {
       "type": "object",
       "properties": {
        "code": {
         "type": "string"
        },
        "payer": {
         "type": "string"
        },
        "detail": {
         "type": "string"
        },
        "selfPay": {
       
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "paid": true,
  "result": {
   "ok": true,
   "service": "subdomain-enumeration"
  },
  "service": "subdomain-enumeration",
  "provider": "K-2SO"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/subdomain-enumeration-via-public-sources-d4b418e2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from k2so.wrong.systems](https://www.zero.xyz/host/k2so.wrong.systems/llms.txt)