Pricing

from $4.00 / 1,000 checked domains

Subdomain Finder - CT Log Enumeration + Live DNS Check

Enumerate a domain's subdomains from Certificate Transparency logs, with an optional live DNS resolve. All subdomains in one record. $0.005 per domain (not per subdomain), far cheaper than paid finders; failures are free.

Pricing

from $4.00 / 1,000 checked domains

Rating

0.0

(0)

Developer

Broke to Built

Actor stats

Bookmarked

Total users

Monthly active users

8 days ago

Last modified

Configure MCP server with Subdomain Finder - CT Logs + Live DNS Resolve

The configuration above connects to the hosted Apify MCP server with the Subdomain Finder - CT Logs + Live DNS Resolve Actor already loaded. It uses OAuth, so your client opens a browser window to sign you in to Apify on first use. No API token is needed. Clients without OAuth support can authenticate with an Authorization: Bearer header carrying an API token from API & Integrations in Apify Console.

Get a ready-to-use configuration for your MCP client with the Subdomain Finder - CT Logs + Live DNS Resolve Actor preconfigured at https://mcp.apify.com/?tools=fetch-actor-details,eliai/subdomain-finder.

You can connect to the Apify MCP Server using clients like Tester MCP Client, or any other MCP client of your choice.

If you want to learn more about our Apify MCP implementation, check out our MCP documentation. To learn more about the Model Context Protocol in general, refer to the official MCP documentation or read our blog post.

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Logiover

Subdomains Finder API - Realtime DNS Subdomain Scanner

dev00/subdomains-finder-api-realtime-dns-subdomain-scanner

High-performance subdomain scanner that retrieves all registered subdomains, IP addresses, and Cloudflare protection status for any given domain.

dev00

Subdomain Finder

happitap/subdomain-finder

Subdomain Finder is a high-speed intelligence tool that uncovers subdomains for any target domain using Certificate Transparency (CT) logs. Unlike traditional brute-force tools, it requires no heavy traffic and provides results in seconds.

HappiTap

Subdomain Finder: Certificate Transparency

glitchbound/subdomain-scraper

Enumerate every subdomain of a domain from public Certificate Transparency logs. No brute-force wordlist and no DNS hammering, because every TLS certificate is logged, so the hosts are already public record. Deduplicated to one row per hostname, with first seen, issuing CA and current validity.

Daniel Meshulam

Domain Intelligence Suite

weeknds/domain-intelligence-suite

WHOIS, DNS, SSL, and subdomain intelligence for any domain in one run. Registration data, DNS records, SSL chain, subdomain discovery from CT logs. Essential for OSINT, security research, penetration testing, and domain due diligence.

C R

Subdomain Finder

mina_safwat/subdomain-finder

Finds every subdomain of a domain from public certificate transparency logs — thousands in under a second, without touching the target

Mina

Subdomain Finder - Discover Every Subdomain Of A Domain

thirdwatch/subdomain-finder

Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.

Thirdwatch

Real Subdomain Finder

onescales/real-subdomain-finder

Discover every subdomain for any domain. Queries 40+ OSINT sources including cert transparency, DNS archives & web scanners. Results enriched with DNS validation, HTTP probing, and subdomain takeover detection. Simple Subdomain Lookup that works!

One Scales

100

5.0

Subdomain Finder — Passive Subdomain Enumeration (Subfinder)

ntriqpro/subfinder-osint

Discover subdomains of any domain fast using the open-source Subfinder engine — passive enumeration from dozens of public sources (certificate transparency, DNS datasets, search engines). For attack-surface mapping and authorized security research.

daehwan kim

Subdomain Discovery API

crawland/subdomain-discovery-api

Paginated subdomain enumeration for any registered domain — DNS records, registrar, WHOIS, vendor reputation, and category labels per subdomain, served from the Crawland threat-intelligence backend.