Pricing

$5.00 / 1,000 subdomains finder - per queries

Subdomains Finder API - Realtime DNS Subdomain Scanner

High-performance subdomain scanner that retrieves all registered subdomains, IP addresses, and Cloudflare protection status for any given domain.

Pricing

$5.00 / 1,000 subdomains finder - per queries

Rating

0.0

(0)

Developer

dev00

Actor stats

Bookmarked

Total users

Monthly active users

4 days ago

Last modified

🔗 Subdomains Finder & DNS Scanner Actor

Instantly scan and find all registered subdomains, Cloudflare protection status, and IP addresses for any target domain.

This Actor integrates with a high-performance Cloudflare Worker edge reverse-proxy to query and retrieve subdomain mapping in real time.

🌟 Key Features

Realtime Subdomain Discovery: Scans and uncovers hidden subdomains instantly.
Resolved IP Mapping: Identifies the IP address for each discovered subdomain.
Cloudflare Protection Audit: Detects whether each subdomain is proxied behind Cloudflare.
Deep Auditing: Saves the full raw response payload to the default Key-Value Store under the OUTPUT key.

📥 Input Parameters

Field	Type	Description	Prefill Example
Target Domain	`string`	The target domain name to scan for subdomains.	`facebook.com`

Input JSON Example

{
  "domain": "facebook.com"
}

📤 Output Data Structure

The dataset outputs the complete JSON response returned by the subdomain scanner:

Output JSON Example

{
  "success": true,
  "data": {
    "status": "success",
    "message": "Success",
    "count": 333,
    "data": [
      {
        "cloudflare": false,
        "ip": "N/A",
        "subdomain": "facebook.com"
      },
      {
        "cloudflare": false,
        "ip": "N/A",
        "subdomain": "m.facebook.com"
      }
    ]
  }
}

💳 Monetization & Cost

This Actor utilizes the Pay-Per-Event (PPE) pricing model on the Apify Store:

Event Name: subdomain-scan
Price per event: $0.005 per successful domain scan.

Subdomain Intelligence OSINT Scanner & Monitor

thescrapelab/subdomain-intelligence-osint

Subdomain finder and OSINT exposure monitor for authorized domains. Discover subdomains, validate DNS, classify live/auth-gated/DNS-only assets, detect technologies and providers, monitor changes, and generate reports.

Inus Grobler

Real Subdomain Finder

onescales/real-subdomain-finder

Discover every subdomain for any domain. Queries 40+ OSINT sources including cert transparency, DNS archives & web scanners. Results enriched with DNS validation, HTTP probing, and subdomain takeover detection. Simple Subdomain Lookup that works!

One Scales

5.0

Subdomain Discovery API

crawland/subdomain-discovery-api

Paginated subdomain enumeration for any registered domain — DNS records, registrar, WHOIS, vendor reputation, and category labels per subdomain, served from the Crawland threat-intelligence backend.

Crawland

Subdomain Finder

happitap/subdomain-finder

Subdomain Finder is a high-speed intelligence tool that uncovers subdomains for any target domain using Certificate Transparency (CT) logs. Unlike traditional brute-force tools, it requires no heavy traffic and provides results in seconds.

HappiTap

Organization Registered Domain & Subdomain Scraper

lofomachines/organization-registered-domain-subdomain-scraper

Discover all domains registered by any organization by company domain. Find related domains, subdomains, registration dates, expiration dates, and registrar information. Perfect for brand protection, competitive analysis, M&A due diligence, and security research.

Lofomachines

Subdomain Finder - Discover Every Subdomain Of A Domain

thirdwatch/subdomain-finder

Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.

Thirdwatch

Domain Intelligence Scanner: WHOIS, DNS, SSL & Subdomains

ntriqpro/domain-intelligence-scanner

Run a full due-diligence scan on any domain in one call: WHOIS registration, DNS records, SSL certificate, subdomain discovery (crt.sh), and technology fingerprint. Built for OSINT, security recon, M&A due diligence, and lead research.