Pricing

from $1.00 / 1,000 result exporteds

Try for free

Go to Apify Store

Subdomain Finder - Certificate Transparency & DNS

Try for free

Enumerate subdomains of any domain from public Certificate Transparency logs and resolve each to IP or CNAME. Returns live status, certificate count, first and last seen dates, issuers and wildcard flag. For attack surface management, authorised recon and vendor discovery. No API key.

Pricing

from $1.00 / 1,000 result exporteds

Rating

0.0

(0)

Developer

Ryan Zinburg

Actor stats

Bookmarked

Total users

Monthly active users

21 hours ago

Last modified

Configure MCP server with Subdomain Finder: Certificate Transparency and DNS

The configuration above connects to the hosted Apify MCP server with the Subdomain Finder: Certificate Transparency and DNS Actor already loaded. It uses OAuth, so your client opens a browser window to sign you in to Apify on first use. No API token is needed. Clients without OAuth support can authenticate with an Authorization: Bearer header carrying an API token from API & Integrations in Apify Console.

Get a ready-to-use configuration for your MCP client with the Subdomain Finder: Certificate Transparency and DNS Actor preconfigured at https://mcp.apify.com/?tools=fetch-actor-details,antishock/subdomain-finder-certificate-transparency.

You can connect to the Apify MCP Server using clients like Tester MCP Client, or any other MCP client of your choice.

If you want to learn more about our Apify MCP implementation, check out our MCP documentation. To learn more about the Model Context Protocol in general, refer to the official MCP documentation or read our blog post.

Certificate Transparency Scraper: Subdomain Discovery

arman-bd/certificate-transparency-scraper

Query certificate transparency logs via crt.sh to enumerate subdomains, issuers, validity windows and certificate history for any domain. Passive attack-surface discovery. no login, no proxy, no browser.

Arman Hossain

Domain Attack Surface & Subdomain Scanner

cypherstone/domain-attack-surface-scanner

Find a domain's subdomains from Certificate Transparency logs, resolve each to its IP, and check the live SSL certificate (issuer, expiry, days left). Open-source recon, no API key.

Jeff Ralston

Subdomain Finder — Certificate Transparency (crt.sh)

bgfc97/crtsh-subdomain-finder

Discover subdomains of any domain from public Certificate Transparency logs (crt.sh). Attack-surface mapping and recon with first/last-seen dates. No key, no proxy.

Bruno

Certificate Transparency & Subdomain Discovery Scraper

scrapers_lat/certificate-transparency-scraper

Discover subdomains and SSL/TLS certificates for any domain from public certificate transparency logs. Extract SAN hostnames, issuer, validity dates, wildcard and expiry flags. Perfect for attack-surface mapping, OSINT and asset inventory. Export to JSON, CSV or Excel.

Scrapers Lat

Certificate Transparency Subdomain Scraper

devilscrapes/crt-sh-certificate-transparency-scraper

Enumerate subdomains and audit certificate hygiene via crt.sh's public Certificate Transparency log — no API key. Get one row per certificate or unique subdomain with computed expiry, wildcard, and freshness signals, capped so a popular domain never blows your bill.

DevilScrapes

Subdomain Finder: Certificate Transparency

glitchbound/subdomain-scraper

Enumerate every subdomain of a domain from public Certificate Transparency logs. No brute-force wordlist and no DNS hammering, because every TLS certificate is logged, so the hosts are already public record. Deduplicated to one row per hostname, with first seen, issuing CA and current validity.

Daniel Meshulam

Subdomain Finder: Certificate Transparency Search

accountable_eel/subdomain-discovery-lookup

Enumerate any domain's real subdomains from the free, public Certificate Transparency log API (certspotter): no login, no scraping. Every subdomain returned had an actual TLS certificate issued for it. Pay only when subdomains are found; domains with no CT history cost nothing.

Adrian Voss

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Logiover

Subdomain Finder – Certificate Transparency

datascraperes/crt-name-subdomain-finder

Find unique subdomains for up to 10,000 domains from live Certificate Transparency records. Normalize URLs, remove wildcard and duplicate hostnames, export structured results, and automate passive asset discovery through the Apify API.

DataScraperES

crt.sh Subdomain Finder - Certificate Search

dataio/crtsh-subdomain-finder

Find every subdomain of a domain from public Certificate Transparency logs (crt.sh), one row per host: days until certificate expiry, issuer, environment inferred from the name (staging, dev, production) and first-seen date. Asset inventory, no API key.