How Does the Merklemap Live Domains API Work?

The Merklemap Live Domains API gives you a real-time stream of newly discovered hostnames, so you can react to new assets as they appear rather than waiting for a periodic scan. It is aimed at security teams, penetration testers, and researchers who need continuous monitoring and threat intelligence. Using it requires an API key and an integration that can consume a streaming feed; the exact endpoint, authentication header, and message format are documented in Merklemap's Search API and Live Domains API sections, so confirm those details there before you build.

What the Live Domains API delivers

Merklemap indexes Certificate Transparency data and subdomains across the internet. The Live Domains API exposes the "newly discovered" part of that index as a stream: instead of querying a static database, you subscribe to hostnames as they are found.

That makes it different from a one-off subdomain lookup. A lookup answers "what exists now?"; the live stream answers "what just appeared?" — which is the signal you want for monitoring an attack surface that changes without warning.

Where the data comes from

• Certificate Transparency logs — new certificates often reveal hostnames before they show up anywhere else.
• Continuous subdomain scanning — Merklemap's database is described as continuously scanning for new subdomains across the internet.
• Historical context — the same platform stores historical subdomain and certificate data, so a live hit can be checked against past records.

Typical use cases

The underlying value is timing: a new subdomain can be an exposed service, a misconfigured deployment, or a phishing setup. Catching it in the stream shortens the window between appearance and response.

How to integrate it

1. Get an API key. The Live Domains API is an authenticated service, so you need credentials from Merklemap. Check the pricing page for what your plan includes before assuming access.
2. Read the Live Domains API docs. Merklemap's documentation covers the endpoint and how to access the real-time stream. Use that as the source of truth for connection details.
3. Build a consumer that handles a stream. A live feed is not a single request/response call — your client needs to stay connected and process events as they arrive, with reconnect logic for dropped connections.
4. Filter to what matters. A global stream of new hostnames is high volume. Filter by the domains, organizations, or keywords relevant to you before alerting.
5. Route events into your workflow. Send matches to a SIEM, a ticketing system, or a monitoring channel so a human or automated check follows up.
6. Verify against historical data. When a hostname appears, cross-check it with Merklemap's historical subdomain and certificate records to judge whether it is genuinely new or a re-discovery.

What to expect at each step

• After authenticating, you should receive a continuous sequence of newly discovered hostnames rather than a fixed list.
• Because the feed is real-time, latency between discovery and delivery depends on your connection and processing, not on a scan schedule.
• If you see nothing, the usual causes are an invalid or missing API key, a filter that excludes everything, or a dropped stream that your client did not reconnect.

Common pitfalls

• Treating it like a search query. The live API is a stream; code written for request/response will not work without adaptation.
• Skipping authentication setup. An API key is required — plan for secure storage and rotation.
• Ignoring volume. Unfiltered streams can overwhelm alerting. Narrow scope first.
• Assuming a new hostname is malicious. A live hit is a lead, not a verdict; validate with certificate and historical data.
• Forgetting the docs. Endpoint paths, parameters, and formats are defined in Merklemap's API documentation — build against that, not against assumptions.

FAQ

Does the Live Domains API replace subdomain search? No. Search and lookup answer what exists; the live stream tells you what is new. They are complementary.

Do I need a paid plan? The API is authenticated and Merklemap publishes a pricing page. Check it for the access your plan provides rather than assuming the API is included.

Can I use it for threat intelligence? Yes — real-time discovery of new hostnames is a common input for monitoring and threat intelligence workflows, especially when combined with certificate analysis.

What if I only need occasional checks? If you do not need continuous monitoring, a standard subdomain and certificate search may be simpler than maintaining a streaming integration.