Skip to content
clusters: prooflayer · edgemarket · edgefinance · synthforge · mediakit · wordmint · webprobe · locale · comppoint · rollforge · bestiary · statline · matchpoint · retail · agentops · browserworkflow · modelrouter · compose
$ man subdomain-enum

/subdomain-enum

agentutility / web-probe / subdomain-enum
PRICE / CALL
$0.03
USDC · base mainnet · scheme: exact
METHOD
POST
CLUSTER
webprobe
CATEGORY
utilities
STATUS
live
NAME
subdomain-enum enumerates a domain's subdomains by mining certificate transparency logs (crt.sh)
SYNOPSIS
POST https://x402.agentutility.ai/subdomain-enum
     Content-Type: application/json
     X-PAYMENT:    <signed-transferWithAuthorization>

     { ... }
↳ first call → 402 Payment Required. Sign USDCtransferWithAuthorization, retry with theX-PAYMENT header.
DESCRIPTION

Enumerates a domain's subdomains by mining Certificate Transparency logs (crt.sh). All-public data; each subdomain comes with first-seen, last-seen, and cert count. Use it for subdomain enumeration, attack-surface mapping, or DNS recon.

INPUTrequest schema
propertytypedescriptionreq?
domainstringrequired
include_wildcardsbooleanoptional
OUTPUTresponse shape
fieldtypedescription
domainstringEchoes the root domain that was enumerated.
subdomain_countnumberTotal number of unique subdomains discovered across mined CT log entries.
subdomainsarrayArray of subdomain records, each with hostname, first-seen date, last-seen date, and cert count.
cert_log_entries_examinednumberNumber of Certificate Transparency log entries scanned from crt.sh for this domain.
sourcestringUpstream data source identifier, typically crt.sh for Certificate Transparency log mining.
notesstringFree-text notes on enumeration coverage, truncation, or caveats about the result set.
EXAMPLEStwo ways to call
EXAMPLE 1 · curl
curl -X POST https://x402.agentutility.ai/subdomain-enum \
  -H 'Content-Type: application/json' \
  -d '{ }'
first response = 402 Payment Required with payment requirements; sign + retry with X-PAYMENT.
EXAMPLE 2 · mcp
# Install the MCP package for this endpoint's cluster
npx -y @agentutility/mcp-<cluster>

# Required: EVM private key with USDC on Base
export X402_PRIVATE_KEY=0x...

# Then call the subdomain-enum tool from your MCP-aware agent.
MCP server handles payment automatically — your coding agent just calls the tool by name.
METADATA
tags
securitysubdomainct-logrecon
methods
POST
cluster
webprobe
price
$0.03 USDC per call
ADJACENTother endpoints in webprobe
endpointdescriptionprice
arxiv-searcharXiv full-text search.$0.03
browser-renderLoads a public URL with JavaScript enabled and returns rendered HTML, title, final URL, byte count, or a base64 screenshot when requested.$0.03
browser-sessionLoads a URL in a real headless browser with JavaScript executed, then returns the rendered HTML and page title, or a base64 screenshot.$0.03
headless-browserOpens a public URL in a real headless browser, waits for client-side rendering, and returns the rendered DOM or a screenshot.$0.03
javascript-renderRenders a URL with JavaScript enabled and returns the browser-rendered HTML, title, resolved URL, and truncation metadata, or captures a…$0.03
ssl-certChecks a domain's SSL certificate: issuer, subject, SAN list, validity dates, and days-until-expiry.$0.03
ssl-cert-infoInspects a domain's SSL/TLS certificate: issuer, subject, SAN list, validity dates, and days-until-expiry.$0.03
ssl-certificate-checkSSL certificate check / TLS certificate expiry API.$0.03
SEE ALSO
agentutility · webprobe · x402 · mcp · llms.txt · registry.json · bazaar.x402.org