Certificate transparency search: subdomains from crt.sh logs

Created by

Anshuman Atrey

Actor

Email & Subdomain Finder - theHarvester OSINT | 54 Sources

List the subdomains a domain's TLS certificates name, from the certificate transparency logs of crt.sh and CertSpotter, with each name checked live in DNS. A quick way to map a company's public attack surface or find forgotten hosts.

Try for free

Email & Subdomain Finder - theHarvester OSINT | 54 Sourcesanshumanatrey/theharvester-osint

Subdomain (host)

Live now? (resolves)

IP address (ip)

Website researched (domain)

+1 field

Input

Website to research (domain)(required):apify.com

Where to search (sources):crtsh+1

Results per source (limit):500

Output fields

Subdomain (host)

Live now? (resolves)

IP address (ip)

Website researched (domain)

Found at (timestamp)

How it works

Sign up on Apify or log in

The Email & Subdomain Finder - theHarvester OSINT | 54 Sources Actor is ready to run with the inputs already set for "Certificate transparency search: subdomains from crt.sh logs". Sign up or log in and you'll land in Apify Console with a copy of this exact task.

Start the "Certificate transparency search: subdomains from crt.sh logs" task

The Email & Subdomain Finder - theHarvester OSINT | 54 Sources Actor will start running based on the input automatically. You can also change all the input fields, like website to research (domain), where to search (sources), and more, to match your specific use case.

Receive the "Certificate transparency search: subdomains from crt.sh logs" output

Monitor the progress in real time. You will be notified as soon as your dataset is complete and ready for review. Each result includes data such as subdomain (host), live now? (resolves), IP address (ip), and more.