How to Use crt.sh to Map a Company's Entire Domain Portfolio: The 2026 OSINT Playbook

• BizVuln Staff

Master crt.sh for complete domain discovery in 2026. Learn certificate transparency, wildcard searches, API automation, and combine with ZoeSquad remediation.

How to Use crt.sh to Map a Company's Entire Domain Portfolio: The 2026 OSINT Playbook

The modern corporate attack surface is no longer defined by a handful of `.com` domains. By 2026, the average enterprise manages hundreds, often thousands, of subdomains, cloud instances, staging environments, and acquired legacy assets—many of which are invisible to traditional inventory tools. This "shadow domain sprawl" is the primary vector for credential theft, misconfiguration exploits, and supply-chain attacks.

Attackers know this. They use openly available sources to map your entire landscape in minutes, while defenders often rely on incomplete CMDBs or manual crawl scripts. The gap is dangerous.

Enter crt.sh—a free, public Certificate Transparency (CT) log search engine. It is arguably the highest-fidelity, lowest-cost OSINT (Open Source Intelligence) tool for discovering every domain that has ever had a TLS certificate issued for it—including wildcards, internal subdomains, and forgotten test servers. When used systematically, crt.sh can reveal the *complete* domain portfolio of any organization, often exposing assets the security team didn't know existed.

In this deep-dive guide, we will show you exactly how to use crt.sh for domain mapping, how to interpret results with 2026-era context, and how to integrate this data into a continuous attack surface management program—with ZoeSquad as your partner for IT remediation when gaps are found.

---

What is crt.sh and Why It’s a Goldmine for Attack Surface Discovery

crt.sh (maintained by the community at Sectigo) is essentially a searchable index of every SSL/TLS certificate that has been submitted to a Certificate Transparency (CT) log since the CT framework became mandatory in Chrome and other browsers around 2018.

Every publicly trusted Certificate Authority (CA) must log issued certificates to one or more CT logs. crt.sh pulls that data and makes it searchable by any field: Common Name (CN), Subject Alternative Name (SAN), issuer, serial number, and fingerprint.

Why this matters for domain portfolio mapping:

In 2026, with the rise of automated certificate management (Let’s Encrypt, ACME), the number of logged certificates has exploded. This also means the false-positive rate has increased—but with proper filtering (discussed below), crt.sh remains the single best starting point for external asset discovery.

---

The Mechanics: How Certificate Transparency Logs Work

To use crt.sh effectively, you need to understand the underlying technology.

Certificate Transparency (CT) in a Nutshell

CT is an open framework that requires CAs to submit every certificate they issue to several public, append-only logs. These logs are cryptographically auditable; anyone can verify that a certificate was included. Browsers (Chrome, Safari, Firefox) now enforce CT for any certificate issued after a certain date.

Key entities:

How crt.sh Aggregates Data

crt.sh maintains a relational database (PostgreSQL) that stores certificates and all associated identities. It provides:

The data is updated in near real-time, often within minutes of a certificate being logged.

---

Step-by-Step: Using crt.sh for Domain Mapping

Basic Search: The "Snoop" Query

Start simple. Go to crt.sh and search:

```

%example.com

```

The `%` is a wildcard (SQL `LIKE`). This returns any certificate where the Common Name or SAN contains `example.com`—including subdomains, subdomain-of-subdomains, and unrelated domains that contain that string (you’ll need to filter).

Example result fields:

Takeaway: The raw output is messy but comprehensive. Copy the list of SANs for further processing.

Wildcard and Advanced Operators

crt.sh supports SQL LIKE wildcards:

Useful queries:

You can also include domain name parts in quotes to exclude false positives. For 2026 best practice, use the `exclude=expired` parameter in the API to ignore outdated certs (though expired certs are still valuable for historical discovery).

API Automation: Scaling Your Recon

Relying on the web GUI is fine for one-off checks, but for continuous monitoring you need the API. crt.sh provides two endpoints:

JSON endpoint:

```

https://crt.sh/?q=example.com&output=json

```

Complex query (URL-encoded):

```

https://crt.sh/?q=%25.example.com&exclude=expired&group=none&output=json

```

Parameters:

Python example (2026-ready):

```python

import requests

import json

def get_crtsh_domains(domain):

url = f"https://crt.sh/?q=%25.{domain}&output=json"

resp = requests.get(url, headers={"User-Agent": "Mozilla/5.0"})

if resp.status_code != 200:

return []

data = resp.json()

domains = set()

for entry in data:

for san in entry.get("name_value", "").split("\n"):

domains.add(san.strip().lower())

return sorted(domains)

print(get_crtsh_domains("example.com"))

```

Note: crt.sh has no official authentication or rate limit enforcement as of 2026, but be polite—add delays and use caching.

---

Interpreting Results: Separating Active Assets from Ghosts

A certificate in crt.sh does not guarantee the domain is still live or reachable. It only proves a certificate was once issued. You must triage:

Certificate Status

DNS Verification

Combine crt.sh results with DNS lookups (`dig`, `nslookup`, or APIs). Use tools like `massdns` to resolve every discovered domain and filter out:

HTTP/S Probes

For domains that resolve, probe HTTP/S to see the response:

A 200 OK with a default IIS or Nginx page often indicates an unmanaged asset.

---

Advanced Techniques: Combining crt.sh with Other OSINT Tools

Subdomain Enumeration

crt.sh is one of the best subdomain sources, but it’s not exhaustive. Combine with:

Many 2026 tools include crt.sh integration out-of-the-box.

Reverse Whois

If you find a domain that looks suspicious (e.g., `example-login.com`), run a reverse whois lookup against the organization name found in the certificate’s organization field (if present). Services like WhoisXML or DomainTools can find other domains registered by the same entity.

Shodan Integration

Take the IPs from resolved subdomains and query Shodan. You may discover open databases, unpatched services, or IoT devices exposed on the same infrastructure. This turns domain mapping into full attack surface visualization.

---

Actionable Checklist for Security Teams

*Use this checklist to perform a one-time or recurring domain portfolio audit using crt.sh:*

1. Identify the primary domain(s) – Gather the main corporate domains (e.g., `company.com`, `company.io`, `company.co.uk`).

2. Run crt.sh wildcard query – `%.company.com` and `company.com` (no %). Record all SANs.

3. Export results to JSON – Use the API to get a machine-readable list.

4. Normalize and deduplicate – Lowercase, remove `*.` wildcard prefixes, handle SANs separated by newlines.

5. Cross-reference with DNS – Resolve each domain; record IPs and DNS record types (A, AAAA, CNAME, MX).

6. Check for internal IPs – Flag any RFC 1918 addresses; these are exfiltrated internal network info.

7. Probe HTTP/S – Use a script to check if services respond; capture response headers and status codes.

8. Identify outliers – Look for domains with patterns like `dev-`, `test-`, `staging-`, `backup-`, `old-`, `vpn-`, `mail-`.

9. Compare against known inventory – Import into your CMDB or asset management tool; mark unknown assets as "discovered."

10. Prioritize remediation – For each unknown asset, determine business owner, patch level, and whether it should be decommissioned or secured.

11. Schedule recurrence – Run this process weekly or monthly; use a CI/CD pipeline to automate.

12. Partner with ZoeSquad – For findings that require IT remediation (patching, retiring, reconfiguring), engage ZoeSquad to handle remediation fast.

---

Frequently Asked Questions

1. Does crt.sh show all domains or only those with HTTPS?

It shows every domain that had a publicly trusted TLS certificate. Non-HTTPS services (only HTTP, FTP, SSH, etc.) will not appear. However, in 2026, the vast majority of external services use HTTPS, so coverage is near-comprehensive.

2. Can I use crt.sh for internal-only domains (e.g., .local)?

Only if the internal domain was issued a publicly trusted certificate (from a CA inside the CT log). Internal CAs (like Active Directory Certificate Services) do not log to public CT logs by default. However, many organizations mistakenly issue public certificates for internal names, which leaks those domains.

3. How often is crt.sh updated?

Generally within minutes to a few hours after a CA logs a certificate. Real-time enough for daily recon, but not for immediate incident response.

4. Is it legal to use crt.sh for OSINT on third parties?

Yes. crt.sh is public data. However, using the data for malicious purposes (e.g., exploitation) is illegal. For authorized security assessments, it’s perfectly acceptable. Always stay within scope of your engagement.

5. crt.sh shows many expired certs. Should I care?

Absolutely. Expired certificates often point to services that are still running but forgotten. The administrator may have stopped renewing the cert but left the server online. These are prime targets for attackers because they are likely unpatched.

6. How can I avoid rate limiting or being blocked?

crt.sh does not aggressively rate-limit in 2026, but you should:

If you need bulk queries, consider downloading the CT log dumps from Google’s CT repository.

7. What’s the difference between crt.sh and censys.io or shodan.io?

crt.sh focuses exclusively on certificate data. Censys and Shodan scan the internet for services and provide additional banners, ports, vulnerabilities. The three complement each other: start with crt.sh for asset discovery, then port-scan with Shodan.

---

Conclusion: Turning Discovery into Continuous Security

Mapping a company’s domain portfolio via crt.sh is not a one-time project—it’s a foundational practice for attack surface management in 2026. With certificate transparency, attackers can find your blind spots faster than your own team. The only defense is to adopt the same OSINT methodology proactively.

By following the techniques in this guide—basic wildcard searches, API automation, DNS verification, and cross-referencing with other tools—you can uncover every domain tied to your organization, expose shadow IT, and prioritize remediation.

But discovery is only the first half. Once you have the list of unknown or unmanaged assets, you need a reliable remediation partner. That’s where ZoeSquad comes in. As experts in IT remediation and cyber hygiene, ZoeSquad can help you quickly patch, decommission, or securely re-configure the assets you find—transforming your OSINT data into real risk reduction.

Don’t let your domain portfolio remain a mystery. Combine the power of crt.sh with the professional remediation support of ZoeSquad to lock down your attack surface in 2026 and beyond.