🛰 Subdomain Finder: Certificate Transparency Scan

Subdomain Finder lists the subdomains of a domain from Certificate Transparency logs (crt.sh, with Cert Spotter failover), then optionally adds HackerTarget, RapidDNS and subdomain.center, DNS answers (IPs, CNAME, Cloudflare flag, wildcard-DNS detection), an HTTP probe (status, title, server) and a wordlist guess. One row per hostname with certificate history. Export CSV, Excel, JSON. No login or API key. $10 per 1,000 subdomains.

Subdomain Finder is a subdomain enumeration tool that is passive by default: with the default settings it only reads public Certificate Transparency (CT) logs and never sends a packet to the target. Switch on resolveIps, httpProbe or bruteForce and it also asks DNS and the hosts themselves, so you can see which names resolve and which answer over HTTP. Built for security teams, in-scope bug bounty hunters and brand-protection analysts.

🔍 What does Subdomain Finder do?

• Lists subdomains from Certificate Transparency logs, the same data behind crt.sh, with first and last seen dates, newest issuer and expiry date.
• Adds passive sources with sources: hackertarget, rapiddns and subdomaincenter (default ["ct"]).
• Resolves hosts with resolveIps: A, AAAA, CNAME, ipAddresses, dnsResolves and a behindCloudflare flag. Wildcard DNS is flagged as wildcardDnsMatch.
• Probes HTTP with httpProbe: isAlive, httpStatus, httpTitle, httpServer and more.
• Guesses common names with bruteForce (small 59 or medium 311 names) using DNS lookups.
• Summarizes each domain (certificates, unique and valid subdomains, top 5 issuers) and can export up to 200 raw certificate rows per domain.
• Survives outages: crt.sh is retried inside 75 seconds, then Cert Spotter, then subdomain.center and RapidDNS (not with onlyValidCerts).

📊 What data can you extract from Certificate Transparency logs?

Field	Row type	Description
recordType	all	subdomain, domain-summary or certificate
domain	all	The root domain you asked for
subdomain	subdomain	Hostname found by a source
isWildcard	subdomain	Yes if the certificate name starts with *.
certCount	subdomain	Number of certificates that cover the hostname (omitted when no CT source answered)
firstSeen, lastSeen	subdomain	Earliest and latest certificate start dates
hasValidCert	subdomain	Yes, No, or Unknown when no CT source answered
latestIssuer, certExpiresAt	subdomain	Issuer organisation and expiry date of the newest certificate
dnsResolves, ipAddresses, cname, behindCloudflare, wildcardDnsMatch	subdomain	DNS answer, Cloudflare range flag, catch-all match (with resolveIps)
isAlive, httpStatus, httpScheme, httpFinalUrl, httpTitle, httpServer, httpResponseMs, httpError	subdomain	HTTP result with httpProbe
totalCertificates, uniqueSubdomains, validSubdomains, hasWildcardDns, topIssuers	domain-summary	Counts for the domain, wildcard-DNS flag, top 5 issuers
crtshId, commonName, issuer, notBefore, notAfter, serialNumber, entryTimestamp	certificate	Raw certificate fields
source, sources	all	Which source answered, and every source that listed the host
crtshUrl, scrapedAt	all	Link to crt.sh and run timestamp

🧾 Sample output of the subdomain scan

On 2026-10-04 crt.sh returned 624 certificates and 129 unique subdomains (46 valid) for mercadolibre.com. When crt.sh is down, Cert Spotter lists only unexpired certificates, so counts are lower. The source column tells you which one answered.

Real row from a cloud run on mercadolibre.com (2026-10-07, Cert Spotter fallback). It predates the DNS and HTTP columns, which are added with resolveIps and httpProbe.

{
  "recordType": "subdomain",
  "domain": "mercadolibre.com",
  "subdomain": "*.hom-proxy-urutec.mercadolibre.com",
  "isWildcard": "Yes",
  "certCount": 1,
  "firstSeen": "2026-04-30T00:00:00",
  "lastSeen": "2026-04-30T00:00:00",
  "hasValidCert": "Yes",
  "source": "certspotter",
  "scrapedAt": "2026-10-07T19:34:15.074Z"
}

💰 How much does it cost to find subdomains?

Pay per event, only for saved results. DNS, HTTP probe, extra sources and wordlist guess add columns at no extra cost.

Event	Price	What you get
Subdomain	$10.00 per 1,000 ($0.01 each)	One unique subdomain row, with DNS and HTTP columns when switched on
Domain scan summary	$0.02 per domain	Totals and top issuers for one domain
Certificate	$10.00 per 1,000 ($0.01 each)	One raw certificate row (off by default)

Worked examples: 1,000 subdomains of one domain cost 1,000 x $0.01 = $10.00, plus $0.02 for its summary = $10.02. Raw certificate rows add up to $2.00 per domain. Small run: resolveIps on, maxItems 5 and the default summary gave 1 summary + 4 hosts, about $0.06 (verified in cloud on 2026-10-10). Large run on microsoft.com with DNS, HTTP probe and medium wordlist: 599 subdomains + 1 summary = $6.01. Error rows, empty scans and failed runs are never billed, and the run stops at your max charge limit.

🚀 How to find all subdomains of a domain (3 steps)

1. Open the actor and enter one or more root domains (up to 2,000), for example apify.com.
2. Set Max Items (default 10), pick sources and toggle the options you want.
3. Click Start, then download the dataset as CSV, Excel, JSON or XML.

⚙️ Input

Field	Type	Default	Description
domains	array	["apify.com"]	Root domains to scan, up to 2,000. URLs and *. prefixes are cleaned up
maxItems	integer	10	Max rows and a cap on spend. Free: 10. Paid: up to 1,000,000
sources	array	["ct"]	ct, hackertarget, rapiddns, subdomaincenter
bruteForce	string	none	none, small (59 names) or medium (311 names), DNS lookups, skipped with onlyValidCerts
onlyValidCerts	boolean	false	Keep only hostnames with a non-expired certificate
includeWildcards	boolean	true	Keep *. entries as their own rows
resolveIps	boolean	false	Add A, AAAA, CNAME, ipAddresses, behindCloudflare
onlyResolving	boolean	false	Drop hosts that do not resolve (turns DNS on)
skipWildcardDnsMatches	boolean	false	Drop hosts that match the catch-all DNS answer (turns DNS on)
httpProbe	boolean	false	Add status, title, server and redirect target
onlyAlive	boolean	false	Keep only hosts that answer over HTTP (turns the probe on)
probeTimeoutSecs	integer	5	Wait per HTTP attempt, 1 to 10 seconds
includeDomainSummary	boolean	true	Add one summary row per domain (billed as its own event)
includeCertificates	boolean	false	Add raw certificate rows (billed as its own event)

{ "domains": ["apify.com"], "resolveIps": true, "httpProbe": true, "includeDomainSummary": false, "maxItems": 5 }

📦 Output

One dataset with three row types set by recordType, in four views. A domain with no certificates gives zero rows and no charge. If every source is down for every domain, or no domain is valid, the run fails with a clear message and no charge.

Limits: no proxy for the HTTP probe (datacenter IPs, so some hosts time out; on microsoft.com 170 of 599 hosts answered), the probe reads only the first 32 KB, HackerTarget allows about 50 requests per day per IP, RapidDNS gives the first 100 rows free. There is no monitoring or only-new mode.

⚖️ Subdomain Finder vs other Apify subdomain actors

Read on 2026-10-10 from the public Apify Store pages.

Dimension	This actor	thirdwatch	happitap and andok
Price	$10 per 1,000 + $0.02 summary	from $0.70 per 1,000	happitap from $0.80; andok from $0.47 per domain scan
Sources	CT with failover, HackerTarget, RapidDNS, subdomain.center	crt.sh, HackerTarget, RapidDNS, brute force	happitap not stated; andok crt.sh and brute force
DNS and HTTP	IPs, CNAME, status, title, server	IPs, status, title, alive flag	happitap IP and Cloudflare flag; andok none shown
Certificate history	counts, first and last seen, issuer, raw rows	not shown	not shown

logiover/subdomain-finder (from $3.50 per 1,000) returns crt.sh and Cert Spotter names with an optional DNS-over-HTTPS check.

We are the most expensive of the five, by roughly 14x against thirdwatch. thirdwatch resolves DNS, probes HTTP and has brute force too, so for a plain live-host list it is the cheaper buy. The extra price here pays for certificate history per host, the valid-certificate flag, issuer analytics per domain, the Cloudflare flag and a failover chain. We show no monitoring mode, and neither does any rival page.

🧰 Use cases

Attack surface management, in-scope bug bounty recon, asset inventory checks, brand protection and takeover triage through the cname field.

🔌 Run via API, schedule and integrations

curl -X POST "https://api.apify.com/v2/acts/RecordsData~subdomain-finder-scraper/runs?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains":["example.com"],"resolveIps":true,"httpProbe":true,"maxItems":100}'

Use the apify-client for Python and JavaScript, schedule runs, or connect Make, Zapier and n8n.

🤖 Subdomain Finder MCP server for AI agents (Claude, Cursor, VS Code)

Connect this actor to any MCP client through the Apify MCP server. Use this URL, which exposes only this actor as a tool:

https://mcp.apify.com?tools=RecordsData/subdomain-finder-scraper

Config for clients that take a JSON MCP config:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com?tools=RecordsData/subdomain-finder-scraper"
    }
  }
}

Example agent prompt: "Use the subdomain finder on example.com with resolveIps and httpProbe on, only valid certificates, then list the hosts that answer over HTTP, their IPs, and the subdomains first seen in the last 90 days."

Tool description: use it when an agent needs subdomain enumeration for a domain it is authorized to assess: Certificate Transparency history, optional passive sources, DNS answers and an HTTP status check per host. It takes the same input as the actor; set maxItems to keep agent runs small and cheap.

🛡️ Is it legal to find subdomains with Certificate Transparency?

Certificate Transparency logs are public by design, and default settings only read them. The optional DNS check, HTTP probe and wordlist guess contact DNS servers and the hosts (one GET per host). Scan only domains you own or are authorized to assess.

❓ Frequently asked questions

How do I find all subdomains of a domain?

Enter the root domain, for example apify.com, in the Subdomain Finder and click Start. It queries Certificate Transparency logs (crt.sh, with Cert Spotter as a fallback) and returns one row for every hostname that ever appeared on a public TLS certificate for that domain, with certificate count, first and last seen and a valid-certificate flag.

Is the Subdomain Finder active scanning?

By default no. With only the default ct source it reads public Certificate Transparency logs, so nothing is sent to the target domain. If you switch on resolveIps, httpProbe or bruteForce, it does send DNS queries and one HTTP request per host. Scan only domains you own or are authorized to assess.

Why did the Subdomain Finder return 0 results?

The domain may have no public certificates in Certificate Transparency logs, or a filter such as onlyValidCerts, onlyResolving or onlyAlive removed every hostname. The run still succeeds, says so in the status message and charges nothing. Try turning the filters off, or check that you entered the root domain.

Why did my Subdomain Finder run fail?

Either the input had no valid domain, or every source (crt.sh, Cert Spotter and the fallback sources) was unavailable for every domain you entered. The run then ends as failed with a clear message and is not charged. Run it again later, because crt.sh outages usually pass within minutes.

Do I pay when crt.sh is down?

No. When crt.sh returns 502 or times out, the actor retries, then asks Cert Spotter, then falls back to subdomain.center and RapidDNS. You pay only for the rows delivered, at the same $0.01 per subdomain. The source field shows which service answered.

What do first seen and last seen mean in the Subdomain Finder?

firstSeen is the earliest certificate start date and lastSeen the latest certificate start date found for that hostname in Certificate Transparency logs. They show when a hostname first got a public certificate and when it was last covered by one, which helps date new or abandoned hosts.

What does the valid-cert flag mean in the Subdomain Finder?

hasValidCert is Yes when at least one certificate covering the hostname expires in the future on the day of the run. It is Unknown when no Certificate Transparency source answered. It is a hint of use, not proof the host is live.

Does a subdomain on a certificate mean the host is live?

Not always. A certificate only proves a certificate was issued for that name, not that a server answers today. Turn on resolveIps for DNS and httpProbe for an HTTP status, then use isAlive, dnsResolves and wildcardDnsMatch.

How many subdomains can one Subdomain Finder run return?

Up to 1,000,000 rows per run on paid plans, set with maxItems. Free users get a 10-row preview. Set maxItems to the number of rows you want to pay for. A run also stops when no new row appears for 90 seconds.

Does the Subdomain Finder need an API key?

No. It reads crt.sh, the public Cert Spotter API and the other listed sources, which need no key, and it paces its requests. You only need an Apify account to run the actor, and free users get a 10-row preview. No crt.sh or Cert Spotter account is needed.

Why is a Subdomain Finder run slow on large domains?

crt.sh is a shared community service, and a large domain can take 25 seconds or more to answer, often with a 502 under load. The actor retries crt.sh inside a 75 second budget, then fails over to Cert Spotter, so very large domains may come back partial.

Why do some Subdomain Finder rows say source certspotter?

Those rows came from the fallback source. Cert Spotter lists only unexpired certificates, so you get current hostnames but not the full historical set that crt.sh holds. Counts are therefore lower and every hostname shows a valid certificate. The source field on each row tells you which service answered.

How do I get only live hosts with IP addresses?

Set resolveIps and httpProbe to true, then add onlyResolving to drop names with no DNS answer, onlyAlive to keep hosts that answer over HTTP, and skipWildcardDnsMatches to drop lookalikes of a catch-all DNS record. Each row then has ipAddresses, httpStatus, httpTitle and behindCloudflare, at no extra charge per row.

🔗 Want related security and domain data? Other RecordsData actors

• Domain Intelligence Scraper: WHOIS/RDAP, DNS and SSL data per domain
• CVE Vulnerabilities Scraper: NVD data with CISA KEV flags
• SEC EDGAR Filings Scraper: breach disclosures in company filings

🆘 Support

Questions or bugs: use the Issues tab on the actor page or write to contact.punkrecordsdata@gmail.com.

Independent tool, not affiliated with crt.sh or any certificate authority.

Last updated: 2026-10-11