Subdomain Finder - CT-log enumeration + live DNS check

Discover a domain's subdomains from public Certificate Transparency logs (crt.sh), then optionally DNS-resolve each one to see which are live and collect their IPs. One clean record per domain listing every subdomain found. Built for attack-surface mapping, asset inventory, and recon.

$0.005 per domain - all its subdomains in one record, not per subdomain. Every other paid subdomain actor bills per subdomain, so a domain with 100+ subdomains costs dollars there and half a cent here. Failures are recorded free.

What you get

• CT-log enumeration via crt.sh for %.<domain> - catches subdomains that never appear in DNS brute-force lists.
• Optional live DNS check (resolve): A/AAAA lookup + CNAME fallback, marks resolves and collects ips.
• De-duplicated, scoped strictly to the target domain, sorted.
• Fail-soft: a domain with no CT records returns subdomainCount: 0 gracefully.

Input

{ "domain": "github.com", "domains": ["example.com"], "resolve": true, "maxDomains": 25 }

Output (real run, 2026-08-07 - 115 subdomains for github.com)

{
  "ok": true,
  "domain": "github.com",
  "subdomainCount": 115,
  "subdomains": [
    { "name": "api.mcp.github.com", "resolves": null, "ips": [] },
    { "name": "api.security.github.com", "resolves": null, "ips": [] },
    { "name": "camo.github.com", "resolves": null, "ips": [] }
  ],
  "checkedAt": "2026-08-07T21:12:00.000Z"
}

With resolve: true, each subdomain also carries resolves: true/false and an ips array.

Pricing - $0.005 per domain, all subdomains included

Every incumbent bills per subdomain; this actor bills per domain. Prices checked via the Apify Store API on 2026-08-07:

Actor	Pricing	A domain with 115 subdomains
This actor	$0.005 per domain	$0.005
happitap/subdomain-finder	$0.0008 per subdomain	$0.092
andok/subdomain-finder	$0.001 per subdomain	$0.115
ntriqpro/subfinder-osint	$0.01 per subdomain-found	$1.15

Per-subdomain billing is only cheaper for domains with fewer than ~6 subdomains; for any real target this actor is far cheaper.

Limits (honest ones)

• Source is Certificate Transparency (crt.sh) - subdomains that never had a public certificate won't appear (no DNS brute-forcing).
• crt.sh is a third-party service; a rare timeout returns a graceful {ok:false, error} record, uncharged.
• With resolve: true, large domains take longer (DNS per subdomain, bounded concurrency).
• maxDomains capped at 100 per run.

FAQ

• Where do the subdomains come from? Public Certificate Transparency logs via crt.sh - real certificates issued for the domain.
• Does it brute-force names? No - CT logs only. That avoids noise and rate-limiting, and finds names a wordlist would miss.
• What does resolve do? Runs a live DNS lookup on each subdomain so you can tell which are actually up.
• Why one record per domain? So you pay once per target, however many subdomains it has.

When not to use this

• You need internal or never-certificated hosts. CT logs only contain names that appeared on a public certificate. A staging box on plain HTTP, or one behind a wildcard cert, will not show up. A DNS brute-forcer with a wordlist is the tool for that, and it costs far more per target.
• You need real-time discovery. CT logs lag issuance by minutes to hours, and crt.sh indexes on its own schedule. A subdomain created five minutes ago may not be there yet.
• You want port scans, tech fingerprints or screenshots of each host. This returns names and (with resolve: true) IPs. Feed those into a scanner or into our HTTP Headers Inspector for the next step.
• You only care about one known hostname's DNS records. Use a DNS records lookup instead - this actor's job is discovering names you did not know about.
• You are not authorized to enumerate the target. CT logs are public, but what you do with an attack-surface map is your responsibility.

Use from code or AI agents

curl -X POST "https://api.apify.com/v2/acts/EliAI~subdomain-finder/runs?token=YOUR_APIFY_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"domain":"github.com","resolve":true}'

Callable as an agent tool through the Apify MCP server (mcp.apify.com).

Related actors

• DNS Records Lookup (EliAI/dns-records-lookup) - returns every DNS record type (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, SRV) for a single domain. This actor discovers subdomain names from Certificate Transparency logs; that one dumps the DNS records of a name you already have.