Subdomain Finder: Certificate Transparency + DNS Resolve

Subdomain Finder

happitap/subdomain-finder

Subdomain Finder is a high-speed intelligence tool that uncovers subdomains for any target domain using Certificate Transparency (CT) logs. Unlike traditional brute-force tools, it requires no heavy traffic and provides results in seconds.

Subdomain & Email Finder — Domain OSINT (theHarvester)

ntriqpro/theharvester-osint

Map the public attack surface of any domain: discover subdomains, hosts, IP addresses and emails from free public OSINT sources (crt.sh, Certspotter, HackerTarget, DuckDuckGo). Powered by theHarvester. No setup, no API keys — for recon, bug-bounty and due diligence.

DNS Lookup

superlativetech/dns-lookup

Bulk DNS records lookup. Query MX, SPF, DMARC, DKIM, TXT, CNAME, A, AAAA, NS, SOA and reverse DNS for any domain or IP. Batch thousands or query one instantly using the Standby API. For domain registration data, see WHOIS Lookup.

Subdomain Finder — Certificate Transparency (crt.sh)

bgfc97/crtsh-subdomain-finder

Discover subdomains of any domain from public Certificate Transparency logs (crt.sh). Attack-surface mapping and recon with first/last-seen dates. No key, no proxy.

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

crt.sh Subdomain Finder - Certificate Search

dataio/crtsh-subdomain-finder

Find every subdomain of a domain from public Certificate Transparency logs (crt.sh), one row per host: days until certificate expiry, issuer, environment inferred from the name (staging, dev, production) and first-seen date. Asset inventory, no API key.

Subdomain Finder: Find All Subdomains via CT Logs & Live DNS

eliai/subdomain-finder

Finds a domain's subdomains from Certificate Transparency logs with optional live DNS check, one domain or up to 100. Flat price: 100 domains cost $0.50, however many subdomains. Runs with limited permissions, so AI agents can call and pay for it through Apify's x402 agentic payments (experimental).

Subdomain Finder: discover every subdomain of a domain from public certificate transparency logs (crt.sh, Cert Spotter), with first/last seen dates, issuers, live DNS (IPs, CNAMEs, hosting provider) and dangling-CNAME and dev/staging flags. Bulk domains. No API key. Pay per subdomain.

Expired Domain Finder with SEO Metrics

constant_quadruped/expired-domain-finder

Find expired and expiring domains enriched with WHOIS data, backlink counts, domain authority, and Wayback Machine history. Quality scored and ranked.