Subdomain Enumeration via Certificate Transparency

Search certificate transparency logs for subdomains.

crt.name queries certificate transparency data, which exposes subdomains that have had TLS certificates issued. A passive way to discover hosts, including forgotten ones.

Why it's useful

Finds subdomains without sending packets to the target.

Category: Reconnaissance & OSINT
Pricing: Free
Tags: recon, certificates, subdomains, ct logs
Link: crt.name