Subdomain Discovery Lookup

Look up any domain's real subdomains against the free, public Certificate Transparency log search API run by SSLMate's certspotter — every subdomain returned had an actual TLS certificate issued for it at some point. No API key, no scraping — this hits the official public CT-log API directly.

Features

• Domain → subdomain list. Every hostname found in CT logs' certificate records for the domain and its subdomains, deduplicated and alphabetically sorted.
• Certificate provenance. Each subdomain comes with firstSeenCertDate — the earliest certificate issuance date on record for that hostname.
• Wildcard-aware. Wildcard certificate entries (*.example.com) are filtered out — only real, individually discovered hostnames are counted.
• Pay only for hits. Domains with no Certificate Transparency history cost nothing — see Pricing.
• Built for bulk. Feed in a list of domains; concurrency and Apify Proxy are configurable.

How to use Subdomain Discovery Lookup - Certificate Transparency API

1. In the Apify Console. Open the actor page and click Start — the items field is already pre-filled with a working example. Results land in the run's dataset as soon as each item is found.
2. Via the API. Call it directly with a POST request — no Console needed once you have an API token:

   curl "https://api.apify.com/v2/acts/accountable_eel~subdomain-discovery-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
     -X POST \
     -H "Content-Type: application/json" \
     -d '{"items":["stripe.com"]}'
   

3. On a schedule. Save this actor as an Apify Task with the input you want, then add a Schedule (hourly, daily, weekly) so it runs on its own — no server of your own required.

Input

{
  "items": ["stripe.com", "example.com"],
  "maxConcurrency": 5,
  "proxyConfiguration": { "useApifyProxy": true }
}

items is a list of domains (or full URLs — protocol, path, and a leading www. are stripped automatically) to enumerate subdomains for. maxConcurrency controls how many lookups run in parallel (default 5, max 20) — kept conservative by default since this target has no browser fallback if it starts blocking. proxyConfiguration configures Apify Proxy; defaults to Apify Proxy enabled.

Output

One row per input domain, for example:

{
  "query": "stripe.com",
  "found": true,
  "data": {
    "domain": "stripe.com",
    "certificatesScanned": 842,
    "subdomainCount": 37,
    "subdomains": [
      { "hostname": "api.stripe.com", "firstSeenCertDate": "2014-03-11T00:00:00Z" },
      { "hostname": "dashboard.stripe.com", "firstSeenCertDate": "2015-07-02T00:00:00Z" }
    ],
    "truncated": false
  },
  "scrapedAt": "2026-08-20T12:00:00.000Z"
}

subdomains is capped at the first 1000 entries (alphabetical); truncated: true flags when a domain has more than that. Domains with no matching certificates in CT logs come back as { "query": "...", "found": false, "scrapedAt": "..." } and are never charged.

Use cases

• Attack-surface mapping. Enumerate every publicly certificate-issued hostname for a domain before a pentest or bug bounty engagement.
• Security monitoring. Track new subdomains appearing in Certificate Transparency logs to catch shadow IT, forgotten staging hosts, or unauthorized deployments.
• M&A and vendor due diligence. Map a target company's real internet footprint from public certificate history, not just its marketing site.
• Bulk domain audits. Feed in a portfolio of company domains and get subdomain counts and hostnames back in a single run.

Pricing

$5 per 1,000 results, plus a $0.005 start fee. Misses (found:false) are never charged.

Use it from Clay, n8n, Make, or an AI agent

This actor runs synchronously over plain HTTP — call it directly from a script, a workflow tool, or an AI agent, no Apify Console needed once you have an API token.

curl "https://api.apify.com/v2/acts/accountable_eel~subdomain-discovery-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"items":["stripe.com"]}'

n8n. Add an HTTP Request node: Method POST, URL https://api.apify.com/v2/acts/accountable_eel~subdomain-discovery-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>, Body Content Type JSON, JSON Body {"items":["stripe.com"]} (swap in an expression from an earlier node for a real value).

Clay. Add an "HTTP API" column: Method POST, URL https://api.apify.com/v2/acts/accountable_eel~subdomain-discovery-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>, Body {"items":["{{value}}"]}, mapping the row's value into the items array.

MCP. In Claude, Cursor, or any MCP client with the Apify MCP server, ask for "Subdomain Discovery Lookup - Certificate Transparency API..." — the agent will find and run this actor.

FAQ

What counts as a "found" result? Any input domain where certspotter's issuances API returns at least one certificate whose dns_names include the domain itself or a genuine subdomain of it. If the API returns no certificates, or nothing survives wildcard filtering, the row comes back found: false and isn't charged.

Do I need to strip https:// or www. from my input? No — domain normalization strips the protocol, any path, and a leading www. automatically before querying.

Is there a limit on how many subdomains are returned per domain? Yes, results are capped at 1000 subdomains per domain, alphabetically sorted; data.truncated is true when a domain has more than that.

Does this need my own API key or login? No — it hits certspotter's free public issuances endpoint with no authentication.

How does concurrency and proxy work? maxConcurrency (default 5, max 20) controls parallel requests; it's kept conservative by default because this actor has no browser fallback if the target starts blocking. proxyConfiguration defaults to Apify Proxy; consider residential proxies if you hit rate limits at high concurrency.

Can I pass thousands of domains in one run? Yes — items accepts any list length; each domain is billed independently and processed at the configured concurrency.