Subdomain Finder - CT-log enumeration + live DNS check

Send a domain, get every subdomain found in Certificate Transparency logs, with an optional live DNS check of each.

You give it	You get back	You pay (Free plan)
One domain or a list of domains	Per domain: subdomain count, each subdomain with resolves true/false and its IPs	$0.005 per domain (not per subdomain)

Pay per result only: no subscription, no start fee. Failed lookups are not charged. Paid Apify plans get Store discounts on the price above.

Try it in one click

The input form is already filled in with this example. Press Start and you get the output below.

{
  "domain": "github.com",
  "domains": [
    "apify.com"
  ]
}

Real output from that exact input (run on 2026-09-24; long arrays shortened to a few entries and long text cut for display):

[
  {
    "ok": true,
    "domain": "apify.com",
    "subdomainCount": 36,
    "subdomains": [
      {
        "name": "affiliate.apify.com",
        "resolves": true,
        "ips": [
          "216.150.16.1",
          "216.150.1.1"
        ]
      },
      {
        "name": "api.integrations-securitybyobscurity.apify.com",
        "resolves": false,
        "ips": []
      }
    ]
  }
]

Discover a domain's subdomains from public Certificate Transparency logs (crt.sh), then optionally DNS-resolve each one to see which are live and collect their IPs. One clean record per domain listing every subdomain found. Built for attack-surface mapping, asset inventory, and recon.

$0.005 per domain - all its subdomains in one record, not per subdomain. Every other paid subdomain actor bills per subdomain, so a domain with 100+ subdomains costs dollars there and half a cent here. Failures are recorded free.

What you get

• CT-log enumeration via crt.sh for %.<domain> - catches subdomains that never appear in DNS brute-force lists.
• Optional live DNS check (resolve): A/AAAA lookup + CNAME fallback, marks resolves and collects ips.
• De-duplicated, scoped strictly to the target domain, sorted.
• Fail-soft: a domain with no CT records returns subdomainCount: 0 gracefully.

Input

{ "domain": "github.com", "domains": ["example.com"], "resolve": true, "maxDomains": 25 }

Output (real run, 2026-08-07 - 115 subdomains for github.com)

{
  "ok": true,
  "domain": "github.com",
  "subdomainCount": 115,
  "subdomains": [
    { "name": "api.mcp.github.com", "resolves": null, "ips": [] },
    { "name": "api.security.github.com", "resolves": null, "ips": [] },
    { "name": "camo.github.com", "resolves": null, "ips": [] }
  ],
  "checkedAt": "2026-08-07T21:12:00.000Z"
}

With resolve: true, each subdomain also carries resolves: true/false and an ips array.

Pricing - $0.005 per domain, all subdomains included

Every incumbent bills per subdomain; this actor bills per domain. Prices checked via the Apify Store API on 2026-08-07:

Actor	Pricing	A domain with 115 subdomains
This actor	$0.005 per domain	$0.005
happitap/subdomain-finder	$0.0008 per subdomain	$0.092
andok/subdomain-finder	$0.001 per subdomain	$0.115
ntriqpro/subfinder-osint	$0.01 per subdomain-found	$1.15

Per-subdomain billing is only cheaper for domains with fewer than ~6 subdomains; for any real target this actor is far cheaper.

Limits (honest ones)

• Source is Certificate Transparency (crt.sh) - subdomains that never had a public certificate won't appear (no DNS brute-forcing).
• crt.sh is a third-party service; a rare timeout returns a graceful {ok:false, error} record, uncharged.
• With resolve: true, large domains take longer (DNS per subdomain, bounded concurrency).
• maxDomains capped at 100 per run.

FAQ

• Where do the subdomains come from? Public Certificate Transparency logs via crt.sh - real certificates issued for the domain.
• Does it brute-force names? No - CT logs only. That avoids noise and rate-limiting, and finds names a wordlist would miss.
• What does resolve do? Runs a live DNS lookup on each subdomain so you can tell which are actually up.
• Why one record per domain? So you pay once per target, however many subdomains it has.

When not to use this

• You need internal or never-certificated hosts. CT logs only contain names that appeared on a public certificate. A staging box on plain HTTP, or one behind a wildcard cert, will not show up. A DNS brute-forcer with a wordlist is the tool for that, and it costs far more per target.
• You need real-time discovery. CT logs lag issuance by minutes to hours, and crt.sh indexes on its own schedule. A subdomain created five minutes ago may not be there yet.
• You want port scans, tech fingerprints or screenshots of each host. This returns names and (with resolve: true) IPs. Feed those into a scanner or into our HTTP Headers Inspector for the next step.
• You only care about one known hostname's DNS records. Use a DNS records lookup instead - this actor's job is discovering names you did not know about.
• You are not authorized to enumerate the target. CT logs are public, but what you do with an attack-surface map is your responsibility.

Use from code or AI agents

curl -X POST "https://api.apify.com/v2/acts/EliAI~subdomain-finder/runs?token=YOUR_APIFY_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"domain":"github.com","resolve":true}'

Callable as an agent tool through the Apify MCP server (mcp.apify.com).

Related actors

• DNS Records Lookup (EliAI/dns-records-lookup) - returns every DNS record type (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, SRV) for a single domain. This actor discovers subdomain names from Certificate Transparency logs; that one dumps the DNS records of a name you already have.

Who uses it

• Bug bounty hunters enumerating a program's subdomains from Certificate Transparency logs
• Security teams inventorying forgotten subdomains that still resolve
• Pentesters mapping attack surface and IPs for a client domain before testing
• IT asset managers finding subdomains teams created outside central DNS tracking
• Researchers comparing how many subdomains a set of companies expose

Changelog

• 2026-09-24: New summary at the top of this page: what you send, what you get, the price, and a real output from the prefilled example.