Domain Attack Surface — SSL + CT Logs + Breach History

What does Domain Attack Surface Suite do?

Domain Attack Surface Suite is an all-in-one domain attack surface scanner that runs SSL certificate inspection, passive subdomain enumeration via Certificate Transparency logs, and data breach history checks in a single automated API call. It is purpose-built as an OSINT reconnaissance tool for security teams, giving you a complete cybersecurity domain audit without juggling three separate services. Results arrive as structured JSON with auto-generated risk flags, ready for SIEM ingestion, dashboards, or Slack alerts.

Why use Domain Attack Surface Suite?

Security teams and businesses rely on this actor because it collapses three time-consuming manual checks into one API call with actionable risk flags.

• CISO Quarterly Audits — Scan your entire domain portfolio overnight. The actor flags SSL_EXPIRED, SSL_EXPIRING_IN_Xd, and DOMAIN_BREACHED so your team focuses on real risks, not spreadsheet management.
• DevSecOps Pipeline Checks — Catch expiring certificates and newly discovered subdomains before they appear in a production incident. Run it on a schedule directly from your CI/CD pipeline.
• Vendor Due Diligence — Assess a vendor's external security posture before signing contracts. A single API call returns their SSL health, shadow subdomains, and breach exposure.
• Bug Bounty Reconnaissance — Passive subdomain discovery from Certificate Transparency logs via crt.sh surfaces assets without triggering IDS alerts — the same source professional bug hunters use.
• M&A Technical Due Diligence — Get a rapid security posture snapshot of acquisition targets. Combine breach history with subdomain sprawl to quantify technical debt before close.

How to use Domain Attack Surface Suite

1. Click Try for free on the Apify Store listing.
2. Enter one or more domains in the domains field (e.g. ["example.com", "api.example.com"]).
3. Optionally add your HIBP API key ($4/month) to enable domain-level breach counts; the free tier still returns the full breach database summary.
4. Adjust expiryWarningDays (default 30) and maxSubdomains (default 100) if needed.
5. Click Start. Each domain takes roughly 10 seconds to analyze.
6. Download results as JSON, CSV, or connect to Zapier / Make for automated alerting.

Input

Field	Type	Required	Default	Description
domains	string[]	Yes	—	Domain names to analyze (e.g. ["example.com"])
hibpApiKey	string	No	—	HIBP API key for domain-level breach counts ($4/month at haveibeenpwned.com)
checkSubdomains	boolean	No	true	Enable passive subdomain enumeration via CT logs (crt.sh)
expiryWarningDays	integer	No	30	Days threshold to trigger SSL_EXPIRING_IN_Xd risk flag
maxSubdomains	integer	No	100	Maximum subdomains returned per domain

Example Input

{
  "domains": ["example.com", "api.example.com"],
  "checkSubdomains": true,
  "expiryWarningDays": 30,
  "maxSubdomains": 100
}

Output

Two record types are pushed to the Apify dataset per run.

domain_analysis record

{
  "_type": "domain_analysis",
  "domain": "example.com",
  "analyzed_at": "2026-06-01T10:00:00+00:00",
  "ssl_ok": true,
  "ssl_expiry": "2026-09-15T12:00:00+00:00",
  "ssl_days_left": 106,
  "ssl_expired": false,
  "ssl_expiring_soon": false,
  "ssl_issuer_cn": "Let's Encrypt Authority X3",
  "ssl_san": ["example.com", "www.example.com"],
  "subdomains_found": 47,
  "subdomain_sample": ["www.example.com", "mail.example.com", "staging.example.com"],
  "risk_flags": []
}

subdomain record

{
  "_type": "subdomain",
  "parent_domain": "example.com",
  "subdomain": "staging.example.com",
  "issuer": "Let's Encrypt Authority X3",
  "not_after": "2026-08-20T00:00:00",
  "logged_at": "2026-03-10T14:22:01.000Z"
}

Data fields

Field	Description
ssl_ok	true if TLS handshake succeeded and certificate is valid
ssl_days_left	Days until certificate expiry (negative = already expired)
ssl_expired	true if certificate is currently expired
ssl_expiring_soon	true if expiry is within expiryWarningDays
ssl_issuer_cn	Certificate issuer common name (e.g. Let's Encrypt)
ssl_san	Subject Alternative Names on the certificate
subdomains_found	Total unique subdomains discovered in CT logs
subdomain_sample	Up to 5 representative subdomains
risk_flags	Auto-generated flags: SSL_EXPIRED, SSL_EXPIRING_IN_Xd, DOMAIN_BREACHED, SSL_ERROR

Cost estimation

Event	Price
Actor start	$0.001 (flat, one-time)
Per domain analyzed	$0.01
Per subdomain discovered	$0.001

Example: 10 domains × 40 subdomains average = $0.001 + (10 × $0.01) + (400 × $0.001) = $0.50 total

Compare to manual alternatives:

Approach	Time	Automation
SSL Labs + crt.sh + HIBP manually	15–30 min per domain	None
This actor	~10 sec per domain	Full API / schedule

FAQ

Do I need an API key to get started? No. SSL certificate checks and CT log subdomain enumeration are completely free with no API key. A HIBP API key ($4/month) is only required for domain-level breach counts showing affected account numbers and breach names.

Does this perform active scanning or port scanning? No. All checks are passive. SSL data comes from a direct TLS handshake, subdomains from the public crt.sh Certificate Transparency log aggregator, and breach data from the Have I Been Pwned public API. No active port scanning or vulnerability probing is performed.

How do I automate regular domain monitoring? Use Apify's built-in scheduler to run this actor daily or weekly on your domain list. Combine it with Apify's webhook integrations to push risk flag alerts to Slack, PagerDuty, or your SIEM automatically.

---

Data sources: SSL via Python ssl stdlib (direct TLS handshake), subdomains via crt.sh Certificate Transparency aggregator, breach data via Have I Been Pwned. This actor performs passive reconnaissance only and does not modify any systems.

---

Related actors

• Domain Breach Checker — Deep HIBP breach lookup for all email addresses found on a domain
• npm Package Security Scanner — Supply chain risk for JavaScript dependencies used by web assets on your domain
• DeFi Hack Monitor — Protocol-level exploit tracking to pair with domain security auditing for crypto projects

Feedback

If this actor powers your security research, a review helps others find it: Leave a review on Apify Store