Every name a certificate has already published.
A certificate is a public statement that a hostname exists. Certificate transparency stores those statements. A light scan turns the ones under your apex into a hostname inventory.
What this gives you
- Primary source is public certificate-transparency data, read by the scan service
- Every SAN in a certificate becomes a candidate hostname
- First-seen dates and wildcard flags are preserved
- No target traffic, no port scans, no brute force
What a light scan reads
Light mode is deliberately narrow: one public source, one request. It is the fastest way to confirm whether a domain has a visible surface at all.
Certificate transparency
The primary source. It answers with names observed in public certificate logs, optionally including a first-seen date.
Subject alternative names
One certificate can list many hosts. Each SAN is parsed separately, de-duplicated, and attributed to the apex it belongs to.
Wildcards
A wildcard certificate is kept as a record and flagged, rather than silently dropped. It tells you the parent label is covered.
- 01
Normalise the input
A URL, a subdomain, a wildcard or a bare apex all reduce to the registered apex before the request is made.
- 02
Read the response
Structured JSON and plain text fallbacks are both accepted. Error payloads are rejected instead of becoming fake hostnames.
- 03
Merge and label
Records are merged by hostname. The earliest date wins, a wildcard flag is sticky, and the source stays attached.
A short-lived cache, not an account.
The scan service reads the public source and caches the result in memory for 24 hours. It also keeps the sites counted toward your free daily allowance. There is no login and no long-term scan history.
No login
Nothing to create, nothing to verify. The tool opens on the scan form.
No account history
Clearing local data removes the browser copy of scans, previews and recent items.
Honest failures
An upstream limit or timeout is reported plainly, with the next step spelled out.