Forelight — Real-time Certificate Transparency alerts for attack surface management

What you catch that crt.sh misses.

crt.sh is a search tool, not a monitoring system. Forelight is a real-time alerting layer with structured enrichment and webhook delivery.

Capability	Forelight	Manual crt.sh
Real-time alerts	Yes — webhook on issuance	No — manual search only
Watchlist filtering	Yes — monitor any apex domain	No
Company enrichment	Name, industry, hosting provider	Raw cert data only
Signal scoring	1–100 risk/signal weight	No
Subdomain enumeration	Continuous, real-time	Periodic, manual
API access	REST + webhooks	No API
Free tier	Yes	Free but no alerting

Four signal types for security teams.

Set a watchlist on your apex domains. Every matching cert fires a signal via webhook or API.

new_subdomain · score 20+

Shadow IT discovery

A new subdomain cert appeared on your domain. Was it authorized? Continuous enumeration without polling.

wildcard_cert_issued · score 70

Wildcard cert alert

*.yourdomain.com issued. Wildcard misissuance or broad-scope certs are a primary attack vector — catch them at issuance.

infrastructure_expansion · score 50

Rapid cert burst

5+ certs in 24h against one apex domain. Automated tooling, staging spin-up, or attack infrastructure — flag it for review.

geographic_expansion · score 85

Unexpected country-code cert

yourcompany.cn just got a cert. Recon, squatting, or unauthorized regional presence — visible the minute it happens.

One API call to monitor any domain.

$ curl -s "https://forelight.net/v1/signals?apex_domain=yourcompany.com&since=2026-07-01T00:00:00Z" \
    -H "Authorization: Bearer YOUR_API_KEY"

# Or set a watchlist once and receive webhooks on every new cert:
$ curl -s -X POST "https://forelight.net/v1/watchlists" \
    -H "Authorization: Bearer YOUR_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"pattern_type": "apex_domain", "pattern": "yourcompany.com"}'

Every cert issued againstyour domain namespace.In real time.