Pricing

from $20.00 / 1,000 domain scanneds

Subdomain Finder — Certificate Transparency (crt.sh)

Discover subdomains of any domain from public Certificate Transparency logs (crt.sh). Attack-surface mapping and recon with first/last-seen dates. No key, no proxy.

Pricing

from $20.00 / 1,000 domain scanneds

Rating

0.0

(0)

Developer

Bruno

Actor stats

Bookmarked

Total users

Monthly active users

3 days ago

Last modified

Input

{ "domains": ["github.com", "tesla.com"], "includeExpired": true }

Output (one row per unique subdomain)

{ "domain": "github.com", "subdomain": "api.github.com", "first_seen": "2021-03-01T00:00:00", "last_seen": "2025-06-10T23:59:59" }

Use cases

Attack-surface mapping / external recon (pentest, bug bounty)
Asset & shadow-IT discovery for security teams
Monitoring new subdomains of your brand or competitors

Notes

Data source: Certificate Transparency logs aggregated by crt.sh.
crt.sh can be busy; requests are retried automatically.
Billed per domain scanned (not per subdomain), so cost is predictable regardless of how many subdomains a domain has.

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Logiover

Real Subdomain Finder

onescales/real-subdomain-finder

Discover every subdomain for any domain. Queries 40+ OSINT sources including cert transparency, DNS archives & web scanners. Results enriched with DNS validation, HTTP probing, and subdomain takeover detection. Simple Subdomain Lookup that works!

One Scales

5.0

(2)

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

Andok

Subdomain Finder - Discover Every Subdomain Of A Domain

thirdwatch/subdomain-finder

Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.

Thirdwatch

Subdomain Finder — CT Log Enumeration + Live DNS Check

eliai/subdomain-finder

Input: a domain. Output: JSON records of subdomains found in public Certificate Transparency logs (crt.sh), each with a live DNS resolution check. Passive recon — no active scanning of the target. Cheap pay-per-result pricing: $0.03 per domain checked.

Anthony Snider

🔍 Subdomain Finder & CT Log Scraper

taroyamada/subdomain-finder

Map website architectures by extracting subdomains from public Certificate Transparency logs to find unlinked staging sites.

naoki anzai

Subdomain Intelligence OSINT Scanner & Monitor

thescrapelab/subdomain-intelligence-osint

Subdomain finder and OSINT exposure monitor for authorized domains. Discover subdomains, validate DNS, classify live/auth-gated/DNS-only assets, detect technologies and providers, monitor changes, and generate reports.

Inus Grobler

SSL Certificate & Subdomain Finder for Any Website

scrapemint/ssl-subdomain-finder

Find all the subdomains of any website and check its SSL certificates. Paste a domain and get every subdomain seen in public certificate records, plus the certificate issuer, valid dates and days until expiry. Great for security checks and finding forgotten sites. No API key needed.

Ken M

Subdomain Finder — Passive Subdomain Enumeration (Subfinder)

ntriqpro/subfinder-osint

Discover subdomains of any domain fast using the open-source Subfinder engine — passive enumeration from dozens of public sources (certificate transparency, DNS datasets, search engines). For attack-surface mapping and authorized security research.

daehwan kim

B2B Sales Triggers - Hiring Surge, Funding, Press, Exec Changes

seibs.co/b2b-sales-triggers

B2B intent data aggregator. For a list of target companies, computes: hiring surge (LinkedIn delta), funding rounds, press mentions, executive changes, tech stack adoption, recent patent filings, customer mentions. Composite trigger score per company. For SDR teams.