Pricing

from $2.50 / 1,000 results

Try for free

Go to Apify Store

Subdomain Takeover Auditor — Find Claimable DNS Records

Try for free

Find dangling DNS records pointing at decommissioned third-party services — the kind anyone can claim to hijack a subdomain of your brand for phishing. Discovers subdomains passively from certificate transparency, resolves CNAMEs, and confirms matches against a public takeover-fingerprint database.

Pricing

from $2.50 / 1,000 results

Rating

0.0

(0)

Developer

alaudin burki

Actor stats

Bookmarked

Total users

Monthly active users

4 days ago

Last modified

Categories

Developer tools

You can access the Subdomain Takeover Auditor — Find Claimable DNS Records programmatically from your own applications by using the Apify API. You can also choose the language preference from below. To use the Apify API, you’ll need an Apify account and your API token, found in API & Integrations in Apify Console.

Python

JavaScript

CLI

OpenAPI

HTTP

MCP

{
  "openapi": "3.0.1",
  "info": {
    "version": "0.1",
    "x-build-id": "BVfOoMarcp1Vo9xqw"
  },
  "servers": [
    {
      "url": "https://api.apify.com/v2"
    }
  ],
  "paths": {
    "/acts/alaudinburki~subdomain-takeover-auditor/run-sync-get-dataset-items": {
      "post": {
        "operationId": "run-sync-get-dataset-items-alaudinburki-subdomain-takeover-auditor",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    },
    "/acts/alaudinburki~subdomain-takeover-auditor/runs": {
      "post": {
        "operationId": "runs-sync-alaudinburki-subdomain-takeover-auditor",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor and returns information about the initiated run in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/runsResponseSchema"
                }
              }
            }
          }
        }
      }
    },
    "/acts/alaudinburki~subdomain-takeover-auditor/run-sync": {
      "post": {
        "operationId": "run-sync-alaudinburki-subdomain-takeover-auditor",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "inputSchema": {
        "type": "object",
        "properties": {
          "domains": {
            "title": "Domains",
            "type": "array",
            "description": "Apex domains to audit, e.g. yourcompany.com. Subdomains are discovered automatically from public certificate transparency logs — you do not need to list them.",
            "items": {
              "type": "string"
            }
          },
          "maxSubdomainsPerDomain": {
            "title": "Max subdomains per domain",
            "minimum": 1,
            "maximum": 2000,
            "type": "integer",
            "description": "Cap on how many discovered subdomains to check per domain.",
            "default": 500
          },
          "confirmWithPageCheck": {
            "title": "Confirm with a page fetch",
            "type": "boolean",
            "description": "For a CNAME that matches a known-vulnerable service, fetch the page once to confirm the takeover fingerprint. Without this, matches are reported as 'suspicious' rather than 'claimable' — turning it off is faster but less certain.",
            "default": true
          },
          "onlyRisky": {
            "title": "Only return risky subdomains",
            "type": "boolean",
            "description": "Return only claimable and suspicious subdomains. Turn off to get every subdomain checked, including the ones that are fine — useful for a full inventory.",
            "default": true
          },
          "concurrency": {
            "title": "Parallel checks",
            "minimum": 1,
            "maximum": 15,
            "type": "integer",
            "description": "How many subdomains to check at once.",
            "default": 8
          },
          "maxItems": {
            "title": "Max results",
            "minimum": 1,
            "type": "integer",
            "description": "Hard cap on rows returned. You are never charged beyond this.",
            "default": 3000
          }
        }
      },
      "runsResponseSchema": {
        "type": "object",
        "properties": {
          "data": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string"
              },
              "actId": {
                "type": "string"
              },
              "userId": {
                "type": "string"
              },
              "startedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "finishedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "status": {
                "type": "string",
                "example": "READY"
              },
              "meta": {
                "type": "object",
                "properties": {
                  "origin": {
                    "type": "string",
                    "example": "API"
                  },
                  "userAgent": {
                    "type": "string"
                  }
                }
              },
              "stats": {
                "type": "object",
                "properties": {
                  "inputBodyLen": {
                    "type": "integer",
                    "example": 2000
                  },
                  "rebootCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "restartCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "resurrectCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "computeUnits": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "options": {
                "type": "object",
                "properties": {
                  "build": {
                    "type": "string",
                    "example": "latest"
                  },
                  "timeoutSecs": {
                    "type": "integer",
                    "example": 300
                  },
                  "memoryMbytes": {
                    "type": "integer",
                    "example": 1024
                  },
                  "diskMbytes": {
                    "type": "integer",
                    "example": 2048
                  }
                }
              },
              "buildId": {
                "type": "string"
              },
              "defaultKeyValueStoreId": {
                "type": "string"
              },
              "defaultDatasetId": {
                "type": "string"
              },
              "defaultRequestQueueId": {
                "type": "string"
              },
              "buildNumber": {
                "type": "string",
                "example": "1.0.0"
              },
              "containerUrl": {
                "type": "string"
              },
              "usage": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "integer",
                    "example": 1
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_UNBLOCKER_UNITS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "usageTotalUsd": {
                "type": "number",
                "example": 0.00005
              },
              "usageUsd": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "number",
                    "example": 0.00005
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_UNBLOCKER_UNITS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

Subdomain Takeover Scanner - Find Risk OpenAPI definition

OpenAPI is a standard for designing and describing RESTful APIs, allowing developers to define API structure, endpoints, and data formats in a machine-readable way. It simplifies API development, integration, and documentation.

OpenAPI is effective when used with AI agents and GPTs by standardizing how these systems interact with various APIs, for reliable integrations and efficient communication.

By defining machine-readable API specifications, OpenAPI allows AI models like GPTs to understand and use varied data sources, improving accuracy. This accelerates development, reduces errors, and provides context-aware responses, making OpenAPI a core component for AI applications.

You can download the OpenAPI definitions for Subdomain Takeover Auditor — Find Claimable DNS Records from the options below:

OpenAPI.json

If you’d like to learn more about how OpenAPI powers GPTs, read our blog post.

You can also check out our other API clients:

Subdomain Takeover Auditor — Find Claimable DNS Records API in Python

Subdomain Takeover Auditor — Find Claimable DNS Records API in JavaScript

Subdomain Takeover Auditor — Find Claimable DNS Records API through CLI

Subdomain Takeover Auditor — Find Claimable DNS Records API

Real Subdomain Finder

onescales/real-subdomain-finder

Discover every subdomain for any domain. Queries 40+ OSINT sources including cert transparency, DNS archives & web scanners. Results enriched with DNS validation, HTTP probing, and subdomain takeover detection. Simple Subdomain Lookup that works!

One Scales

113

5.0

Subdomain Finder (Certificate Transparency)

webdatatools/subdomain-finder

Subdomain Finder enumerates every subdomain of a domain from Certificate Transparency logs (crt.sh, Cert Spotter) and resolves each one — one row per subdomain, no proxies needed.

Murat Uzun

Subdomain Finder: Bulk Certificate Transparency Search

accountable_eel/subdomain-discovery-lookup

Find subdomains for a list of domains without an API key: bulk subdomain enumeration from the free public Certificate Transparency logs (certspotter), a crt.sh alternative. Every subdomain returned had a real TLS certificate issued for it, with its first-seen date. Send rows to Google Sheets.

Adrian Voss

HarvestHawk — URL Archive + Subdomain Takeover Scanner

inexhaustible_glass/url-harvester

Every known URL of a domain from 6 free archives (Wayback, Common Crawl, AlienVault OTX, URLScan, crt.sh, sitemap) merged and deduped — PLUS a live subdomain-takeover risk and public S3-bucket exposure check on every subdomain found. Block-proof, no API key, no login.

Hitman studio

Subdomain Takeover & Forgotten Asset Finder

magebase/subdomain-takeover-finder

Dangling CNAME records pointing to abandoned S3 buckets or Heroku apps leave corporate domains vulnerable to hostile takeovers.

magebase

Subdomain Finder - CT Log Enumeration + Live DNS Check

eliai/subdomain-finder

Enumerate a domain's subdomains from Certificate Transparency logs, with an optional live DNS resolve. All subdomains in one record. $0.005 per domain (not per subdomain), far cheaper than paid finders; failures are free.

Broke to Built

Subdomain Finder - Discover Every Subdomain Of A Domain

thirdwatch/subdomain-finder

Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.

Thirdwatch

Domain Intelligence — DNS, WHOIS, SSL & Subdomains

dalbian/domain-intelligence

Full public record for any domain: DNS records of every type, RDAP registration details, mail security posture (SPF, DMARC, DKIM), detected providers, and every subdomain and SSL certificate from the Certificate Transparency logs.

Benjamin Jerez

Subdomain Finder

mina_safwat/subdomain-finder

Finds every subdomain of a domain from public certificate transparency logs — thousands in under a second, without touching the target

Mina

Subdomain Discovery API

crawland/subdomain-discovery-api

Paginated subdomain enumeration for any registered domain — DNS records, registrar, WHOIS, vendor reputation, and category labels per subdomain, served from the Crawland threat-intelligence backend.