$ man subdomain-enum
/subdomain-enum(1)
PRICE / CALL
$0.03
USDC · base mainnet · scheme: exact
METHOD
POST
CLUSTER
webprobeCATEGORY
utilities
STATUS
● live
NAME
subdomain-enum — subdomain enumeration / attack-surface mapping / dns recon
SYNOPSIS
POST https://x402.org/v1/subdomain-enum
Content-Type: application/json
X-PAYMENT: <signed-transferWithAuthorization>
{ ... }↳ first call →
402 Payment Required. Sign USDCtransferWithAuthorization, retry with theX-PAYMENT header.DESCRIPTION
Subdomain enumeration / attack-surface mapping / DNS recon. Certificate Transparency log mining (crt.sh). All-public data. Each subdomain with first-seen, last-seen, cert count.
INPUT — request schema
| property | type | description | req? |
|---|---|---|---|
| domain | string | Root domain to enumerate subdomains for (e.g. example.com); no protocol or path. | required |
| include_wildcards | boolean | Include *.example.com entries. Default false. | optional |
OUTPUT — response shape
| field | type | description |
|---|---|---|
| domain | string | Echoes the root domain that was enumerated. |
| subdomain_count | number | Total number of unique subdomains discovered across mined CT log entries. |
| subdomains | array | Array of subdomain records, each with hostname, first-seen date, last-seen date, and cert count. |
| cert_log_entries_examined | number | Number of Certificate Transparency log entries scanned from crt.sh for this domain. |
| source | string | Upstream data source identifier, typically crt.sh for Certificate Transparency log mining. |
| notes | string | Free-text notes on enumeration coverage, truncation, or caveats about the result set. |
EXAMPLES — two ways to call
EXAMPLE 1 · curl
curl -X POST https://x402.org/v1/subdomain-enum \
-H 'Content-Type: application/json' \
-d '{ }'first response =
402 Payment Required with payment requirements; sign + retry with X-PAYMENT.EXAMPLE 2 · mcp
# install once claude mcp add x402 --command "npx x402-deployer-mcp" # then ask Claude Code: # "use the subdomain-enum tool to ..."
MCP server handles payment automatically — your coding agent just calls the tool by name.
METADATA
- tags
- securitysubdomainct-logrecon
- methods
- POST
- cluster
- webprobe
- price
- $0.03 USDC per call
ADJACENT — other endpoints in webprobe
| endpoint | description | price |
|---|---|---|
| arxiv-search | arXiv full-text search. | $0.03 |
| ssl-cert | SSL certificate inspector / TLS cert checker / certificate transparency lookup / ssl expiry. | $0.03 |
| ssl-cert-info | SSL / TLS certificate inspector. | $0.03 |
| archive-snapshot | Wayback Machine API / archive.org wrapper. | $0.02 |
| dmarc-check | DMARC / SPF / DKIM checker. | $0.02 |
| dns-lookup | DNS lookup / DNS resolver / DoH proxy. | $0.02 |
| expand-url | URL expander / redirect chain tracer / link-shortener resolver. | $0.02 |
| password-strength | Password strength meter + breach checker. | $0.02 |
SEE ALSO