Skip to content
clusters: prooflayer · edgemarket · edgefinance · synthforge · mediakit · wordmint · webprobe · locale · comppoint
$ man subdomain-enum

/subdomain-enum(1)

agentutility / web-probe / subdomain-enum
PRICE / CALL
$0.03
USDC · base mainnet · scheme: exact
METHOD
POST
CLUSTER
webprobe
CATEGORY
utilities
STATUS
live
NAME
subdomain-enum subdomain enumeration / attack-surface mapping / dns recon
SYNOPSIS
POST https://x402.org/v1/subdomain-enum
     Content-Type: application/json
     X-PAYMENT:    <signed-transferWithAuthorization>

     { ... }
↳ first call → 402 Payment Required. Sign USDCtransferWithAuthorization, retry with theX-PAYMENT header.
DESCRIPTION

Subdomain enumeration / attack-surface mapping / DNS recon. Certificate Transparency log mining (crt.sh). All-public data. Each subdomain with first-seen, last-seen, cert count.

INPUTrequest schema
propertytypedescriptionreq?
domainstringRoot domain to enumerate subdomains for (e.g. example.com); no protocol or path.required
include_wildcardsbooleanInclude *.example.com entries. Default false.optional
OUTPUTresponse shape
fieldtypedescription
domainstringEchoes the root domain that was enumerated.
subdomain_countnumberTotal number of unique subdomains discovered across mined CT log entries.
subdomainsarrayArray of subdomain records, each with hostname, first-seen date, last-seen date, and cert count.
cert_log_entries_examinednumberNumber of Certificate Transparency log entries scanned from crt.sh for this domain.
sourcestringUpstream data source identifier, typically crt.sh for Certificate Transparency log mining.
notesstringFree-text notes on enumeration coverage, truncation, or caveats about the result set.
EXAMPLEStwo ways to call
EXAMPLE 1 · curl
curl -X POST https://x402.org/v1/subdomain-enum \
  -H 'Content-Type: application/json' \
  -d '{ }'
first response = 402 Payment Required with payment requirements; sign + retry with X-PAYMENT.
EXAMPLE 2 · mcp
# install once
claude mcp add x402 --command "npx x402-deployer-mcp"

# then ask Claude Code:
# "use the subdomain-enum tool to ..."
MCP server handles payment automatically — your coding agent just calls the tool by name.
METADATA
tags
securitysubdomainct-logrecon
methods
POST
cluster
webprobe
price
$0.03 USDC per call
ADJACENTother endpoints in webprobe
endpointdescriptionprice
arxiv-searcharXiv full-text search.$0.03
ssl-certSSL certificate inspector / TLS cert checker / certificate transparency lookup / ssl expiry.$0.03
ssl-cert-infoSSL / TLS certificate inspector.$0.03
archive-snapshotWayback Machine API / archive.org wrapper.$0.02
dmarc-checkDMARC / SPF / DKIM checker.$0.02
dns-lookupDNS lookup / DNS resolver / DoH proxy.$0.02
expand-urlURL expander / redirect chain tracer / link-shortener resolver.$0.02
password-strengthPassword strength meter + breach checker.$0.02
SEE ALSO
agentutility(7) · webprobe(7) · x402(7) · mcp(7) · llms.txt · registry.json · bazaar.x402.org