SubdomainShadowPulse: what does your public certificate footprint say about your attack surface?
SubdomainShadowPulse is a free, read-only check with 6 automated tests: A free, passive summary of the TLS certificates publicly logged for your domain in Certificate Transparency: how many hostnames, how many new in the last 30 days, certificates expiring soon, wildcard use and hostnames whose certificates lapsed. Full hostname lists are only for verified owners. Results are instant; copy-paste fixes and monitoring start at $4.99. It is also available to AI agents as the MCP tool summarize_certificate_footprint.
A free, passive summary of the TLS certificates publicly logged for your domain in Certificate Transparency: how many hostnames, how many new in the last 30 days, certificates expiring soon, wildcard use and hostnames whose certificates lapsed. Full hostname lists are only for verified owners.
Unlock the complete deliverable
Your free check above is complete. The fix pack adds a copy-paste fix for every item that needs attention. The first 3 are below, free.
Tailor unlock for:
Card, Apple Pay, Google Pay or Link via Stripe; refunds on request within 14 days.
✓ Read-only, live public data · Key and unlock right after payment · Card, Apple Pay, Google Pay or Link via Stripe · Refunds on request within 14 days
Preview what the unlock includes
- A copy-paste fix for every check that needs attention, written for your page
- Where each fix goes (page HTML, server headers or DNS) and how to confirm it
- Re-run the free check any time to verify
Already paid? Enter your key or email to unlock
Passive and informational: uses only public Certificate Transparency logs (crt.sh); no requests are sent to your hosts and nothing is probed or port-scanned. Public reports show counts only; the hostname list is available only to verified domain owners or agencies attesting authorization. Findings are review items, not confirmed vulnerabilities.
Plans
Copy-Paste Fix Pack
$4.99 one-time
- One-time $4.99: copy-paste fixes for every failing check on one domain
- Unlocked instantly with your key
Weekly Monitor (5 domains)
$9 / month ($0.30/day)
- Weekly read-only re-check of up to 5 domains. Billed monthly (or yearly at the annual price); cancel any time
- Change log on your watch dashboard and API, plus email alerts on changes
Agency 50-Domain Pro
$49 / month ($1.61/day)
- Daily checks for up to 50 client domains. Billed monthly (or yearly at the annual price); cancel any time
- Change log, CSV export and API access
More ways to buy
500 API / MCP Credits
$9.99 one-time
- 500 full (unredacted) REST or MCP calls across every product
- Credits never expire
Unlimited API / MCP Key
$29 / month
- Unlimited full REST and MCP calls across every product. Billed monthly (or yearly at the annual price); cancel any time
- For Make, Zapier, n8n and AI agents
Watch My Domain
$5 / month
- Weekly read-only re-check of one domain. Billed monthly (or yearly at the annual price); cancel any time
- Email when the result changes
White-Label Client Report
$9.99 one-time
- One downloadable client-ready HTML report with your agency name and domain in the header
- No branding from us
Agency White-Label Pass
$79 / month
- Unlimited white-label client reports for this tool. Billed monthly (or yearly at the annual price); cancel any time
API: 10 free calls per day without a key. Datasets contain public records only, at organization level.
Payments are processed securely by Stripe. Refunds are available by default within the first 14 days of paid service.
Copy-paste fix pack
Verify your domain to see full detail
Full per-domain detail is only shown to the domain's owner. Enter your domain and key to get a DNS TXT record; add it, then check. Agencies on an agency plan can instead attest that the owner authorized them (POST /v1/verify/domain/attest).