How Does Merklemap Work?

Merklemap works by collecting Certificate Transparency (CT) data, continuously scanning the internet for new subdomains, and indexing that data so you can search for subdomains and SSL/TLS certificates tied to any organization. It is built for security researchers, penetration testers, and teams that want to map an attack surface or validate digital assets. You do not need to run your own scans to get results; the value comes from querying Merklemap's existing index and, where relevant, its APIs.

The data source: Certificate Transparency logs

The core input is Certificate Transparency data. When a certificate is issued for a domain, it is typically recorded in public CT logs. Merklemap collects and stores this CT data to provide comprehensive search capabilities.

Because certificates are issued for hostnames, CT logs act as a record of subdomains that have had certificates. That is why Merklemap can surface subdomains that are not linked from a website's main pages.

What this means in practice

• A subdomain that once had a certificate can appear in results even if it is no longer advertised.
• Certificate details (issuer, validity, configuration signals) are part of what you can analyze.
• The dataset is historical as well as current, so you can track changes over time.

Continuous scanning for new subdomains

Merklemap's database continuously scans for new subdomains across the internet. This is separate from simply reading CT logs: the scanning process expands coverage so newly discovered hostnames enter the index.

The practical effect is that results are not a one-time snapshot. If an organization adds a subdomain, it can show up in later searches without you re-running anything locally.

Indexing and search

Collected CT data and discovered subdomains are indexed to support search and queries. The website describes a subdomain and certificate transparency search engine: you search, and Merklemap returns matching subdomains and certificates from its index.

Two programmatic access points are documented:

The Search API fits lookups and integration into your own tooling. The Live Domains API fits monitoring: you receive newly discovered hostnames as they appear rather than polling for them.

Historical data and change tracking

Merklemap provides historical subdomain and certificate data. This supports:

• Tracking changes over time
• Monitoring certificate renewals
• Detecting potential security risks by comparing past and present states

For example, if you are validating an organization's digital assets, historical data can show a subdomain that existed earlier and may still resolve, even if it is absent from current documentation.

What you can do with it

The stated uses are subdomain enumeration, certificate analysis, and historical review:

• Subdomain enumeration — uncover hidden subdomains that may reveal sensitive information or potential attack surfaces.
• Certificate analysis — inspect SSL/TLS configuration signals, including misconfigurations, weak ciphers, or expired certificates.
• Historical data — track trends and certificate renewals over time.

These combine into reconnaissance and attack-surface monitoring for security research and penetration testing.

Limits and conditions to keep in mind

• Merklemap is a search and indexing service over CT and scan data; it does not replace your own validation of whether a host is live or what it serves.
• API use is a separate capability from the web search interface. If you need automation or streaming, plan around the Search API or Live Domains API rather than manual queries.
• Pricing and account requirements are not established by the available material; check the site's pricing page for current terms before assuming free or unrestricted access.

If your goal is a one-off lookup, the search interface is the direct path. If your goal is continuous monitoring or integration, the APIs are the relevant entry points.