# Domain Attack Surface & Subdomain Scanner (`cypherstone/domain-attack-surface-scanner`) Actor

Find a domain's subdomains from Certificate Transparency logs, resolve each to its IP, and check the live SSL certificate (issuer, expiry, days left). Open-source recon, no API key.

- **URL**: https://apify.com/cypherstone/domain-attack-surface-scanner.md
- **Developed by:** [Jeff Ralston](https://apify.com/cypherstone) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.50 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

**Domain Attack Surface & Subdomain Scanner** maps a domain's external footprint from open sources: it finds subdomains from **Certificate Transparency logs**, resolves each to its **IP address**, and inspects the live **SSL/TLS certificate** (issuer, expiry date, days remaining) — one clean row per host. No login, no API key, no personal data. It's a fast subdomain finder and attack-surface scanner in one.

### What can the Domain Attack Surface Scanner do?

- **Find all subdomains of a domain** using two Certificate Transparency sources (certSpotter + crt.sh), automatically deduplicated.
- **Check which subdomains are live** by resolving DNS and reporting the IP.
- **Audit SSL certificates** — see the issuer, expiry date, and days-until-expiry for every live host, so you can catch **certificates about to expire**.
- **Monitor your external attack surface** — run it on a schedule and diff the results to catch new or forgotten subdomains before someone else does.
- **Do recon on any domain** you're authorized to assess — a lightweight alternative to heavyweight security suites.

### What data does the subdomain scanner return?

| Field | Type | Example |
|-------|------|---------|
| domain | string | example.com |
| subdomain | string | www.example.com |
| ip | string | 172.66.147.243 |
| status | string | live / no-dns |
| ssl\_issuer | string | SSL Corporation |
| ssl\_expires | string | Oct 27 22:17:21 2026 GMT |
| ssl\_days\_left | string | 44 |
| source | string | certspotter / crt.sh / both |

> **Domains and infrastructure, not people.** This scanner maps hostnames, IPs, and certificates — public technical facts. It collects no personal data.

### How much does the attack surface scanner cost?

Pay-per-result — **you're charged only per host returned**. Runs are cheap because it uses lightweight HTTP + DNS/TLS lookups (no heavy browser, no proxies), so there's no separate compute or proxy bill.

| Tier | Price | Best for |
|------|-------|----------|
| Free trial | first small batch free | scanning your own domain |
| Pay-as-you-go | low per-result | one-off recon |
| Scheduled monitor | per-event | daily attack-surface change alerts |

### How do I scan a domain? (step by step)

1. **Enter one or more domains** (e.g. `example.com`).
2. **Set max hosts** per domain.
3. **Run it.** Download the results as JSON, CSV, or Excel, or pull them via the Apify API.
4. *(Optional)* **Schedule it** and diff the dataset to get alerted on new subdomains or soon-to-expire certificates.

### Input

```json
{ "domains": ["example.com"], "max_hosts": 100 }
```

### Output (one row per subdomain)

```json
{
  "domain": "example.com",
  "subdomain": "www.example.com",
  "ip": "172.66.147.243",
  "status": "live",
  "ssl_issuer": "SSL Corporation",
  "ssl_expires": "Oct 27 22:17:21 2026 GMT",
  "ssl_days_left": "44",
  "source": "both"
}
```

### Who uses a subdomain & attack-surface scanner?

- **Security teams & pentesters** — map an authorized target's external footprint fast.
- **IT / DevOps** — inventory your own subdomains and catch expiring SSL certificates before they cause outages.
- **Bug-bounty hunters** — quick recon and subdomain discovery on in-scope programs.
- **Domain owners** — find forgotten or shadow subdomains you didn't know were exposed.

### FAQ

**Do I need an API key?** No. It reads public Certificate Transparency logs, DNS, and TLS handshakes — no account or key.

**Which subdomains does it find?** Anything that has appeared in a public SSL certificate for the domain (via certSpotter and crt.sh). It won't find subdomains that never had a certificate, but CT coverage is broad and it merges two sources for completeness.

**Is this legal?** It queries only public infrastructure data (certificate logs, DNS, public TLS certificates) — no logins, no private systems, no personal data. Only scan domains you own or are authorized to assess.

**Can it alert me to expiring certificates or new subdomains?** Yes — schedule it and compare runs; `ssl_days_left` and the subdomain list make change-detection straightforward.

**What formats can I export?** JSON, CSV, Excel, plus the Apify API and integrations.

# Actor input Schema

## `domains` (type: `array`):

Root domains to map (e.g. example.com). Subdomains are discovered from Certificate Transparency logs.

## `max_hosts` (type: `integer`):

Cap the number of subdomains probed per domain. Keep small for a quick test.

## Actor input object example

```json
{
  "domains": [
    "example.com"
  ],
  "max_hosts": 25
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "example.com"
    ],
    "max_hosts": 25
};

// Run the Actor and wait for it to finish
const run = await client.actor("cypherstone/domain-attack-surface-scanner").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": ["example.com"],
    "max_hosts": 25,
}

# Run the Actor and wait for it to finish
run = client.actor("cypherstone/domain-attack-surface-scanner").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "example.com"
  ],
  "max_hosts": 25
}' |
apify call cypherstone/domain-attack-surface-scanner --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,cypherstone/domain-attack-surface-scanner"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/zfSxb3I0p9LZVX37B/builds/NV1IIDBsLzCJj6CX5/openapi.json