merklemap.com

The Merklemap Live Domains API gives you a real-time stream of newly discovered hostnames, so you can react to new assets as they appear rather than waiting for a periodic scan. It is aimed at security teams, penetration testers, and researchers who need continuous monitoring and threat intelligence. Using it requires an API key and an integration that can consume a streaming feed; the exact endpoint, authentication header, and message format are documented in Merklemap's Search API and Live Domains API sections, so confirm those details there before you build.

What the Live Domains API delivers

Merklemap indexes Certificate Transparency data and subdomains across the internet. The Live Domains API exposes the "newly discovered" part of that index as a stream: instead of querying a static database, you subscribe to hostnames as they are found.

That makes it different from a one-off subdomain lookup. A lookup answers "what exists now?"; the live stream answers "what just appeared?" — which is the signal you want for monitoring an attack surface that changes without warning.

Where the data comes from

• Certificate Transparency logs — new certificates often reveal hostnames before they show up anywhere else.
• Continuous subdomain scanning — Merklemap's database is described as continuously scanning for new subdomains across the internet.
• Historical context — the same platform stores historical subdomain and certificate data, so a live hit can be checked against past records.

Typical use cases

The underlying value is timing: a new subdomain can be an exposed service, a misconfigured deployment, or a phishing setup. Catching it in the stream shortens the window between appearance and response.

How to integrate it

1. Get an API key. The Live Domains API is an authenticated service, so you need credentials from Merklemap. Check the pricing page for what your plan includes before assuming access.
2. Read the Live Domains API docs. Merklemap's documentation covers the endpoint and how to access the real-time stream. Use that as the source of truth for connection details.
3. Build a consumer that handles a stream. A live feed is not a single request/response call — your client needs to stay connected and process events as they arrive, with reconnect logic for dropped connections.
4. Filter to what matters. A global stream of new hostnames is high volume. Filter by the domains, organizations, or keywords relevant to you before alerting.
5. Route events into your workflow. Send matches to a SIEM, a ticketing system, or a monitoring channel so a human or automated check follows up.
6. Verify against historical data. When a hostname appears, cross-check it with Merklemap's historical subdomain and certificate records to judge whether it is genuinely new or a re-discovery.

What to expect at each step

• After authenticating, you should receive a continuous sequence of newly discovered hostnames rather than a fixed list.
• Because the feed is real-time, latency between discovery and delivery depends on your connection and processing, not on a scan schedule.
• If you see nothing, the usual causes are an invalid or missing API key, a filter that excludes everything, or a dropped stream that your client did not reconnect.

Common pitfalls

• Treating it like a search query. The live API is a stream; code written for request/response will not work without adaptation.
• Skipping authentication setup. An API key is required — plan for secure storage and rotation.
• Ignoring volume. Unfiltered streams can overwhelm alerting. Narrow scope first.
• Assuming a new hostname is malicious. A live hit is a lead, not a verdict; validate with certificate and historical data.
• Forgetting the docs. Endpoint paths, parameters, and formats are defined in Merklemap's API documentation — build against that, not against assumptions.

FAQ

Does the Live Domains API replace subdomain search? No. Search and lookup answer what exists; the live stream tells you what is new. They are complementary.

Do I need a paid plan? The API is authenticated and Merklemap publishes a pricing page. Check it for the access your plan provides rather than assuming the API is included.

Can I use it for threat intelligence? Yes — real-time discovery of new hostnames is a common input for monitoring and threat intelligence workflows, especially when combined with certificate analysis.

What if I only need occasional checks? If you do not need continuous monitoring, a standard subdomain and certificate search may be simpler than maintaining a streaming integration.

Merklemap's main benefit for certificate transparency (CT) searches is that it turns raw CT log data into a searchable index of subdomains and SSL/TLS certificates, so you can find hidden assets, review certificate configuration, and track changes over time without building your own CT log pipeline. It fits reconnaissance, attack-surface monitoring, and security research work where you need a broad view of an organization's public footprint. The specific value depends on your use case: asset discovery, certificate hygiene checks, or historical tracking.

Discovering hidden subdomains and attack surface

Certificate transparency logs record every certificate a CA issues, and each entry typically includes the hostnames covered. That makes CT a reliable source for subdomains that never appear in DNS zone files or search engine indexes.

Merklemap indexes this data and exposes it through search, so you can:

• Find subdomains linked to a target domain that may reveal sensitive information or expose new attack surfaces.
• Validate your own digital assets by comparing what you know exists against what certificates reveal.
• Support penetration testing by starting from a more complete hostname list.

The practical gain is coverage. A single certificate can list dozens of names, including internal-sounding hosts, staging environments, and legacy services that were never meant to be public. Because the data comes from CT logs rather than active scanning, you see names that may no longer resolve but still indicate past infrastructure.

Analyzing SSL/TLS configuration and certificate health

Beyond hostname discovery, Merklemap lets you inspect the certificates themselves. The site describes certificate analysis as a way to gain insight into an organization's SSL/TLS configuration and to identify:

• Misconfigurations
• Weak ciphers
• Expired certificates

This matters because certificate data is a proxy for how an organization manages its trust infrastructure. A certificate that expired and was never replaced, or one issued with an unexpectedly broad set of names, tells you something about operational discipline. For defenders, it is a checklist item; for testers, it is a lead.

Accessing historical data to track changes

Merklemap stores CT data over time, which enables historical views of subdomains and certificates. That supports:

Historical comparison is often more useful than a single snapshot: a new subdomain appearing after your last audit is a concrete signal to investigate.

Programmatic access for repeatable workflows

Merklemap documents two APIs alongside the web search:

• Search API — programmatically search for subdomains and certificates.
• Live Domains API — access real-time streams of newly discovered hostnames.

If your reconnaissance or monitoring runs on a schedule, these let you fold CT data into existing tooling instead of querying manually. The Live Domains API is the relevant one when you want to react to newly issued certificates rather than search after the fact.

Who benefits most

• Security researchers and penetration testers — broader initial hostname lists and certificate context before active testing.
• Organizations monitoring their own footprint — a way to see what CT logs expose about them and to catch shadow assets.
• Anyone validating digital assets — cross-checking known infrastructure against certificate-issued names.

Limits to keep in mind

CT search shows what certificates reveal, not what is currently live or reachable. A hostname in a CT log may be decommissioned, internal-only, or a wildcard artifact. Treat results as leads to verify, not confirmed assets. The site also lists a pricing page, so check current plan terms before assuming feature or usage limits for your volume.

Merklemap works by collecting Certificate Transparency (CT) data, continuously scanning the internet for new subdomains, and indexing that data so you can search for subdomains and SSL/TLS certificates tied to any organization. It is built for security researchers, penetration testers, and teams that want to map an attack surface or validate digital assets. You do not need to run your own scans to get results; the value comes from querying Merklemap's existing index and, where relevant, its APIs.

The data source: Certificate Transparency logs

The core input is Certificate Transparency data. When a certificate is issued for a domain, it is typically recorded in public CT logs. Merklemap collects and stores this CT data to provide comprehensive search capabilities.

Because certificates are issued for hostnames, CT logs act as a record of subdomains that have had certificates. That is why Merklemap can surface subdomains that are not linked from a website's main pages.

What this means in practice

• A subdomain that once had a certificate can appear in results even if it is no longer advertised.
• Certificate details (issuer, validity, configuration signals) are part of what you can analyze.
• The dataset is historical as well as current, so you can track changes over time.

Continuous scanning for new subdomains

Merklemap's database continuously scans for new subdomains across the internet. This is separate from simply reading CT logs: the scanning process expands coverage so newly discovered hostnames enter the index.

The practical effect is that results are not a one-time snapshot. If an organization adds a subdomain, it can show up in later searches without you re-running anything locally.

Indexing and search

Collected CT data and discovered subdomains are indexed to support search and queries. The website describes a subdomain and certificate transparency search engine: you search, and Merklemap returns matching subdomains and certificates from its index.

Two programmatic access points are documented:

The Search API fits lookups and integration into your own tooling. The Live Domains API fits monitoring: you receive newly discovered hostnames as they appear rather than polling for them.

Historical data and change tracking

Merklemap provides historical subdomain and certificate data. This supports:

• Tracking changes over time
• Monitoring certificate renewals
• Detecting potential security risks by comparing past and present states

For example, if you are validating an organization's digital assets, historical data can show a subdomain that existed earlier and may still resolve, even if it is absent from current documentation.

What you can do with it

The stated uses are subdomain enumeration, certificate analysis, and historical review:

• Subdomain enumeration — uncover hidden subdomains that may reveal sensitive information or potential attack surfaces.
• Certificate analysis — inspect SSL/TLS configuration signals, including misconfigurations, weak ciphers, or expired certificates.
• Historical data — track trends and certificate renewals over time.

These combine into reconnaissance and attack-surface monitoring for security research and penetration testing.

Limits and conditions to keep in mind

• Merklemap is a search and indexing service over CT and scan data; it does not replace your own validation of whether a host is live or what it serves.
• API use is a separate capability from the web search interface. If you need automation or streaming, plan around the Search API or Live Domains API rather than manual queries.
• Pricing and account requirements are not established by the available material; check the site's pricing page for current terms before assuming free or unrestricted access.

If your goal is a one-off lookup, the search interface is the direct path. If your goal is continuous monitoring or integration, the APIs are the relevant entry points.

Merklemap is a search engine for subdomains and SSL/TLS certificates, built on Certificate Transparency (CT) data. It indexes subdomains and certificates across the internet so you can look up the digital assets and trust infrastructure tied to an organization. It fits reconnaissance and asset-discovery tasks: security research, penetration testing, attack-surface monitoring, and validating which subdomains and certificates actually belong to a target.

What Merklemap does

The core idea is combining two data views that are usually separate:

• Subdomain enumeration — surfaces subdomains that may expose sensitive information or additional attack surface. The database is described as continuously scanning for new subdomains across the internet.
• Certificate analysis — shows an organization's SSL/TLS configuration so you can spot misconfigurations, weak ciphers, or expired certificates.
• Historical data — lets you track subdomain and certificate changes over time, monitor certificate renewals, and detect shifts that may signal risk.

Because CT logs record certificates as they are issued, certificate data is a practical way to discover hostnames that never appear in a site's navigation or sitemap. Merklemap's value is making that data searchable rather than requiring you to parse raw logs yourself.

How it works

Merklemap collects and stores Certificate Transparency data, then exposes it through search. According to the site's own documentation, the workflow is:

1. CT data is collected and stored to build comprehensive search coverage.
2. You query that data for subdomains and certificates associated with a target.
3. Results give you a view of an organization's digital assets and security posture.

For example, if you are scoping a penetration test, you would search a domain to build a hostname list, then review the associated certificates for expiry, weak configuration, or hosts you did not know existed.

Ways to access the data

Merklemap offers more than a web search box:

The Live Domains API is the piece to note if you want continuous monitoring rather than one-off lookups — it streams hostnames as they are discovered instead of waiting for you to re-run a search.

Who it is for

• Security researchers mapping an organization's exposed assets.
• Penetration testers building hostname and certificate inventories during reconnaissance.
• Organizations monitoring their own attack surface and certificate health.

The common thread is proactive security: finding and mitigating exposed assets before someone else does.

Practical limits to keep in mind

• Merklemap is a discovery and analysis tool, not a scanner — it tells you what exists, not whether a host is vulnerable.
• Coverage depends on CT data, so assets that never had a publicly logged certificate may not appear.
• Pricing and account requirements are not detailed here; check the site's pricing page before assuming free access.

If your task is finding subdomains or auditing certificates for a domain, Merklemap is a direct fit. If you need active vulnerability testing or live host scanning, pair it with a separate tool.

Merklemap exposes a Search API for programmatically querying subdomains and SSL/TLS certificates, plus a separate Live Domains API for real-time streams of newly discovered hostnames. Both are documented on the site, and the Search API is the one to use for batch lookups and custom analysis. The catch: the available page evidence confirms these APIs exist and what they're for, but it does not publish authentication details, endpoints, rate limits, or request formats — so you'll need to read the official API docs before writing any code.

What the Search API is for

According to Merklemap's own documentation index, the Search API lets you "programmatically search for subdomains and certificates." That maps to two practical jobs:

• Bulk enumeration — pull subdomain and certificate records for many domains in one automated run instead of typing each into the web UI.
• Tool integration — feed results into your own recon scripts, dashboards, or security tooling.

The underlying data comes from Certificate Transparency logs, which Merklemap indexes and stores. The site describes the result as a view of an organization's "digital assets and trust infrastructure," including historical records so you can track changes over time.

Search API vs. Live Domains API

Merklemap documents two distinct programmatic interfaces. Pick based on whether you want to query on demand or subscribe to a stream.

If your goal is "give me everything for these 500 domains," use the Search API. If your goal is "tell me when a new subdomain appears," the Live Domains API is the fit.

How to get started

The site's documentation is organized into an Introduction, a "How It Works" section, and dedicated pages for the Search API and Live Domains API. The practical sequence:

1. Read the Search API doc page first. It's where authentication and request details live. The page evidence does not include them, so don't assume a scheme — check the source.
2. Confirm your access tier. Merklemap has a pricing page, which suggests access levels may differ. Whether the API requires a paid plan is not stated in the available material, so verify before building.
3. Start with a single-domain query to confirm your auth works and to see the response shape.
4. Scale to batch queries once the single call behaves as expected.
5. Add the Live Domains API separately if you need streaming rather than polling.

What you can do with the results

The site frames the value around proactive security: uncovering hidden assets, monitoring attack surface, and identifying certificate issues such as misconfigurations, weak ciphers, or expired certificates. Concretely, API output supports:

• Attack-surface mapping — enumerate subdomains that may expose sensitive services.
• Certificate hygiene checks — spot expiring or misconfigured TLS certificates across a portfolio.
• Change tracking — use historical data to monitor certificate renewals and detect shifts over time.

Common sticking points

• Skipping the docs. The most likely failure is guessing at endpoints or auth. The documentation pages are the authoritative source; the marketing pages are not.
• Assuming free access. A pricing page exists, but the evidence doesn't say the API is free or paid. Check your plan before you build a pipeline on it.
• Confusing the two APIs. Querying the Search API in a loop won't give you real-time discovery — that's the Live Domains API's job.
• Treating CT data as complete. CT-based enumeration reflects what's been logged in certificates, which is broad but not identical to every hostname that exists.

For anything beyond these general steps — exact endpoints, auth method, rate limits, and pricing — go directly to Merklemap's Search API documentation and pricing page.