Subdomain Finder (CT Logs + DNS)

Map the full attack surface of any domain by discovering subdomains through certificate transparency logs and optional DNS brute-force. Security audits and penetration tests start with knowing what is exposed — yet manual subdomain enumeration is slow and incomplete. Scan multiple domains in bulk with configurable concurrency and get structured results ready for downstream security tools.

Features

• Certificate transparency — queries crt.sh to find subdomains from publicly issued TLS certificates
• DNS brute-force — optional wordlist-based subdomain discovery for common names like api, staging, admin
• Bulk scanning — process multiple root domains in a single run
• Configurable concurrency — control parallel lookups from 1 to 25 simultaneous queries
• Source tracking — reports how many subdomains came from each discovery method
• Custom wordlists — extend or replace the default brute-force wordlist with your own terms
• Charge limit support — respects the Apify max charge per run to control costs

Input

Field	Type	Required	Default	Description
domains	array	No	["example.com"]	Root domains to scan for subdomains
domain	string	No	—	Single domain to scan (backwards compatible, use domains for bulk)
useCertificateTransparency	boolean	No	true	Query certificate transparency logs (crt.sh) for subdomain discovery
useDnsBruteforce	boolean	No	false	Check a wordlist of common subdomain names via DNS resolution
bruteforceWords	array	No	["www", "mail", "api", ...]	Custom wordlist for DNS brute-force. Only used when brute-force is enabled
timeoutSeconds	integer	No	15	Timeout in seconds for each DNS or HTTP request
concurrency	integer	No	5	Number of parallel domain lookups (1-25)

Input Example

{
  "domains": ["example.com", "example.org"],
  "useCertificateTransparency": true,
  "useDnsBruteforce": true,
  "concurrency": 10
}

Output

Each root domain produces one dataset item with all discovered subdomains and source counts.

Key fields:

• domain (string) — the root domain that was scanned
• subdomainCount (integer) — total number of unique subdomains found
• subdomains (array) — sorted list of all discovered subdomains
• sources (object) — count of subdomains found per method (crtsh, dnsBruteforce)
• checkedAt (string) — ISO 8601 timestamp of the scan
• error (string | null) — any issues encountered during the scan

Output Example

{
  "domain": "example.com",
  "subdomainCount": 12,
  "subdomains": [
    "api.example.com",
    "blog.example.com",
    "cdn.example.com",
    "dev.example.com",
    "mail.example.com",
    "staging.example.com",
    "status.example.com",
    "support.example.com",
    "vpn.example.com",
    "wiki.example.com",
    "www.example.com",
    "zabbix.example.com"
  ],
  "sources": {
    "crtsh": 10,
    "dnsBruteforce": 4
  },
  "checkedAt": "2025-03-09T14:30:00.000Z",
  "error": null
}

Pricing

Event	Cost
Domain Scan	Pay-per-event pricing applies

Set ACTOR_MAX_TOTAL_CHARGE_USD to control maximum spending per run.

Use Cases

• Penetration testing reconnaissance — discover all exposed subdomains before beginning a security assessment
• Attack surface management — schedule weekly scans to detect new or unauthorized subdomains as they appear
• Brand protection — find subdomains that may have been forgotten, misconfigured, or hijacked
• Certificate audit preparation — enumerate subdomains to feed into SSL certificate monitoring
• Infrastructure inventory — build a complete map of subdomains across multiple client domains for MSPs and agencies

Related Actors

Actor	What it adds
DNS Propagation Checker	Verify DNS records for discovered subdomains across global resolvers
SSL Certificate Monitor	Check SSL certificate health for every subdomain found
Security Headers Analyzer	Audit HTTP security headers on discovered subdomains

Notes

• Certificate transparency results depend on crt.sh availability. If crt.sh is temporarily down, the actor logs the error and continues with DNS brute-force if enabled.
• DNS brute-force only checks the provided wordlist — it does not perform exhaustive enumeration. Extend bruteforceWords for deeper coverage.