What Is Merklemap? Subdomain and Certificate Transparency Search Explained

Merklemap is a search engine for subdomains and SSL/TLS certificates, built on Certificate Transparency (CT) data. It indexes subdomains and certificates across the internet so you can look up the digital assets and trust infrastructure tied to an organization. It fits reconnaissance and asset-discovery tasks: security research, penetration testing, attack-surface monitoring, and validating which subdomains and certificates actually belong to a target.

What Merklemap does

The core idea is combining two data views that are usually separate:

• Subdomain enumeration — surfaces subdomains that may expose sensitive information or additional attack surface. The database is described as continuously scanning for new subdomains across the internet.
• Certificate analysis — shows an organization's SSL/TLS configuration so you can spot misconfigurations, weak ciphers, or expired certificates.
• Historical data — lets you track subdomain and certificate changes over time, monitor certificate renewals, and detect shifts that may signal risk.

Because CT logs record certificates as they are issued, certificate data is a practical way to discover hostnames that never appear in a site's navigation or sitemap. Merklemap's value is making that data searchable rather than requiring you to parse raw logs yourself.

How it works

Merklemap collects and stores Certificate Transparency data, then exposes it through search. According to the site's own documentation, the workflow is:

1. CT data is collected and stored to build comprehensive search coverage.
2. You query that data for subdomains and certificates associated with a target.
3. Results give you a view of an organization's digital assets and security posture.

For example, if you are scoping a penetration test, you would search a domain to build a hostname list, then review the associated certificates for expiry, weak configuration, or hosts you did not know existed.

Ways to access the data

Merklemap offers more than a web search box:

The Live Domains API is the piece to note if you want continuous monitoring rather than one-off lookups — it streams hostnames as they are discovered instead of waiting for you to re-run a search.

Who it is for

• Security researchers mapping an organization's exposed assets.
• Penetration testers building hostname and certificate inventories during reconnaissance.
• Organizations monitoring their own attack surface and certificate health.

The common thread is proactive security: finding and mitigating exposed assets before someone else does.

Practical limits to keep in mind

• Merklemap is a discovery and analysis tool, not a scanner — it tells you what exists, not whether a host is vulnerable.
• Coverage depends on CT data, so assets that never had a publicly logged certificate may not appear.
• Pricing and account requirements are not detailed here; check the site's pricing page before assuming free access.

If your task is finding subdomains or auditing certificates for a domain, Merklemap is a direct fit. If you need active vulnerability testing or live host scanning, pair it with a separate tool.