Pivot map
Use this map to decide whether Cert Graph Crawler accepts the lead you are holding, and what kind of lead it may return for the next step.
Pivot from here
Outputs from Cert Graph Crawler can become inputs for the next tool. These are the most relevant follow-on pivots in the library.
A global, open, stable, and secure Internet that serves the entire Asia Pacific community
ARIN is a nonprofit, member-based organization that administers IP addresses & ASNs in support of the operation and growth of the Internet.
AbuseIPDB provides IP reputation data and community abuse reports for identifying malicious hosts in network and threat investigations.
AccountKiller provides direct deletion links and step-by-step instructions for removing accounts on hundreds of websites and social platforms.
Investigator Use
CertGraph Crawler is an open-source Go tool available on GitHub that enumerates subdomains and related domains by crawling SSL/TLS certificate transparency logs. It maps the certificate relationships between domains, revealing subdomains, affiliated infrastructure, and historically issued certificates that might not be discoverable through DNS enumeration alone.
For OSINT investigators conducting infrastructure reconnaissance, CertGraph provides a distinct data source from traditional DNS brute-forcing. Certificate transparency (CT) logs record every publicly trusted SSL/TLS certificate issued by certificate authorities, and each certificate contains the domain names it was issued for. CertGraph crawls these logs to extract and map all certificates associated with a target domain.
The certificate graph perspective reveals organizational relationships between domains that share certificates or certificate characteristics. When a threat actor or corporate entity uses the same certificate for multiple domains, CertGraph's graph visualization exposes these connections — revealing affiliated infrastructure that would not be visible through standard DNS or WHOIS analysis.
Historical certificate records are particularly valuable. CT logs maintain records of all previously issued certificates, including those for domains that no longer exist or have changed ownership. Investigating the certificate history of a target domain can reveal previously used subdomains, infrastructure that has been decommissioned, and the evolution of an organization's web infrastructure over time.
For brand protection and phishing investigations, CertGraph can identify domains that have obtained certificates closely resembling a protected brand's domain — a common pre-attack step for phishing infrastructure. Certificate issuance for lookalike domains often precedes the activation of the phishing site.
CertGraph outputs a graph data structure that can be imported into visualization tools (Gephi, Maltego) for analysis of complex infrastructure relationships. The graph perspective is especially useful when investigating organizations with large, interconnected domain portfolios.
Installation requires Go. Run against target domains with appropriate authorization. For investigative documentation, record the target domain, CT log sources queried, certificate data extracted, and any affiliated domains discovered.
Before You Pivot
Capture the target, search terms, and why this source is relevant before you leave the page.
Archive volatile pages, save screenshots, and keep timestamps for anything that may change.
Treat one tool as a lead source. Confirm important findings with independent sources.
Related tools
ARIN is a nonprofit, member-based organization that administers IP addresses & ASNs in support of the operation and growth of the Internet.
Free online network tools, including traceroute, nslookup, dig, whois, ping, and our own Domain Dossier and Email Dossier. Works with IPv6.
Finds certificates and subdomains using Certificate Transparency data. An alternative to crt.sh that presents the information a bit differently.
DNS History archives historical DNS records, letting investigators track IP changes, hosting migrations, and infrastructure pivots over time.
DNS Twister generates and monitors domain permutations for typosquatting detection, brand protection, and phishing infrastructure discovery.
Free DNS, WHOIS, and email-authentication lookups for any domain: SPF analysis with the 10-lookup limit check, DKIM selector discovery, DMARC checks, email header analysis, and blacklist checks. Results explain in plain English what each record means. No account needed for basic lookups; free API tier available.