Pricing

$30.00 / 1,000 domain checkeds

Subdomain Finder — CT Log Enumeration + Live DNS Check

Input: a domain. Output: JSON records of subdomains found in public Certificate Transparency logs (crt.sh), each with a live DNS resolution check. Passive recon — no active scanning of the target. Cheap pay-per-result pricing: $0.03 per domain checked.

Pricing

$30.00 / 1,000 domain checkeds

Rating

0.0

(0)

Developer

Anthony Snider

Actor stats

Bookmarked

Total users

Monthly active users

4 days ago

Last modified

Subdomain Finder (CT Logs)

Discover every subdomain of any domain in seconds — straight from public Certificate Transparency logs. Passive recon, no port scanning, no noise, plus an optional live DNS check that tells you which subdomains actually resolve.

Live on the Apify Store — run it instantly, or call it as an agent tool via Apify MCP.

What you get

Full subdomain inventory from crt.sh Certificate Transparency logs (wildcards stripped, deduped, scoped to your domain).
Live/dead status per subdomain via real DNS resolution (A/AAAA, with CNAME fallback).
Resolved IPs for each live host — instant asset map for security recon, attack-surface review, or migration audits.
Single or bulk — one domain or a whole list in one run.
Fully passive: it never touches the target's servers, only public logs and DNS.

Input

{
  "domain": "github.com",
  "resolve": true,
  "maxDomains": 25
}

Field	Type	Default	Description
`domain`	string	—	A single domain (scheme/path/wildcards auto-stripped).
`domains`	array	—	Multiple domains in one run.
`resolve`	boolean	`true`	Resolve each subdomain via DNS to mark it live + collect IPs.
`maxDomains`	integer	`25`	Cap on domains processed per run (max 100).

Output

One dataset item per domain:

{
  "domain": "github.com",
  "subdomainCount": 3,
  "subdomains": [
    { "name": "api.github.com", "resolves": true, "ips": ["140.82.112.6"] },
    { "name": "gist.github.com", "resolves": true, "ips": ["140.82.113.4"] },
    { "name": "old.github.com", "resolves": false, "ips": [] }
  ],
  "checkedAt": "2026-06-24T00:00:00.000Z"
}

When resolve is false, each subdomain is returned with resolves: null and an empty ips array for a fast passive-only listing.

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Logiover

Subdomain Finder - Discover Every Subdomain Of A Domain

thirdwatch/subdomain-finder

Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.

Thirdwatch

Subdomain Finder — Passive Subdomain Enumeration (Subfinder)

ntriqpro/subfinder-osint

Discover subdomains of any domain fast using the open-source Subfinder engine — passive enumeration from dozens of public sources (certificate transparency, DNS datasets, search engines). For attack-surface mapping and authorized security research.

daehwan kim

Domain OSINT Recon

prooflio/domain-osint-recon

Aggregates WHOIS, DNS records, certificate-transparency subdomains and PTR records for a domain into one structured report.

Prooflio AI

5.0

Domain Intelligence Scanner: WHOIS, DNS, SSL & Subdomains

ntriqpro/domain-intelligence-scanner

Run a full due-diligence scan on any domain in one call: WHOIS registration, DNS records, SSL certificate, subdomain discovery (crt.sh), and technology fingerprint. Built for OSINT, security recon, M&A due diligence, and lead research.

daehwan kim

Certificate Transparency Monitor — AI Agent Recon API

logiover/certificate-transparency-monitor

Keyless certificate transparency intelligence for AI agents: crt.sh CT logs. Track new TLS certs for any domain, discover subdomains via wildcard, batch domains. Issuer, validity, SAN domains and serial per row. No API key, no browser.

Logiover

MX Record Checker - Verify a Domain Can Receive Email

eliai/mx-record-checker

Check a domain's mail servers via DNS. Input: domains (list). Output: JSON per domain with MX records and priorities, canReceiveEmail flag, and resolved A records for each mail host. Cheap pay-per-result: $0.01 per domain checked.

Anthony Snider

DNS Records Lookup - All Record Types for Any Domain

eliai/dns-records-lookup

Look up every DNS record type for a domain in one call. Input: domains (list). Output: JSON per domain with A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, SRV, PTR records and values. Cheap pay-per-result: $0.02 per domain checked.

Anthony Snider

🔍 Subdomain Finder & CT Log Scraper

taroyamada/subdomain-finder

Map website architectures by extracting subdomains from public Certificate Transparency logs to find unlinked staging sites.

naoki anzai

Subdomain Finder

happitap/subdomain-finder

Subdomain Finder is a high-speed intelligence tool that uncovers subdomains for any target domain using Certificate Transparency (CT) logs. Unlike traditional brute-force tools, it requires no heavy traffic and provides results in seconds.