crt.name
crt.name is a fast subdomain enumeration and discovery service built around a continuously updated index of domain names. It ingests Certificate Transparency data as new entries appear and supplements it with historical and external datasets to improve coverage.
Key Features
- Subdomain Enumeration — Enter an apex domain to retrieve known subdomains associated with it.
- Certificate Transparency Monitoring — Processes usable CT logs as entries arrive to discover newly issued hostnames.
- Historical Coverage — Supplements live CT data with retired logs and other historical datasets.
- Additional Discovery Sources — Incorporates data from sources such as Common Crawl, zone files, DNS datasets, and hostname probing.
- First-Seen Dates — Tracks when each indexed hostname was first observed.
- Large Index — Maintains billions of indexed apex domains and subdomains for broad reconnaissance coverage.
- Free API — Query the subdomain index programmatically without an API token, subject to request limits.
- JSON Output — API queries can return structured JSON for integration into reconnaissance pipelines.
- MCP Support — Provides an MCP endpoint that enables compatible agent clients to query the index.
- CLI Integration — Available as a default source in subfaster for command-line subdomain enumeration.
Security Use Cases
crt.name is useful during reconnaissance, attack-surface mapping, penetration testing, and bug bounty research. Security researchers can use discovered hostnames to identify APIs, development environments, administrative interfaces, legacy infrastructure, and other externally exposed assets that may warrant further investigation.
