Pricing

from $4.00 / 1,000 checked domains

Try for free

Go to Apify Store

Subdomain Finder - All Subdomains via CT Logs + Live DNS

Try for free

Finds a domain's subdomains from Certificate Transparency logs, with an optional live DNS check of each, for one domain or up to 100. Returns one record per domain with the deduplicated subdomains, which ones resolve and their IPs. For bug bounty hunters, pentesters and security teams.

Pricing

from $4.00 / 1,000 checked domains

Rating

0.0

(0)

Developer

Broke to Built

Actor stats

Bookmarked

Total users

Monthly active users

5 days ago

Last modified

Categories

Developer tools

SEO tools

Automation

Security

You can access the Subdomain Finder - All Subdomains via CT Logs + Live DNS programmatically from your own applications by using the Apify API. You can also choose the language preference from below. To use the Apify API, you’ll need an Apify account and your API token, found in API & Integrations in Apify Console.

Python

JavaScript

CLI

OpenAPI

HTTP

MCP

1from apify_client import ApifyClient
2
3# Initialize the ApifyClient with your Apify API token
4# Replace '<YOUR_API_TOKEN>' with your token.
5client = ApifyClient("<YOUR_API_TOKEN>")
6
7# Prepare the Actor input
8run_input = {
9    "domain": "github.com",
10    "domains": ["apify.com"],
11}
12
13# Run the Actor and wait for it to finish
14run = client.actor("eliai/subdomain-finder").call(run_input=run_input)
15
16# Fetch and print Actor results from the run's dataset (if there are any)
17print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
18for item in client.dataset(run.default_dataset_id).iterate_items():
19    print(item)
20
21# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

Subdomain Finder API: Enumerate Subdomains from CT Logs API in Python

The Apify API client for Python is the official library that allows you to use Subdomain Finder - All Subdomains via CT Logs + Live DNS API in Python, providing convenience functions and automatic retries on errors.

Install the apify-client

$pip install apify-client

Other API clients include:

Subdomain Finder - All Subdomains via CT Logs + Live DNS API in JavaScript

Subdomain Finder - All Subdomains via CT Logs + Live DNS API through CLI

Subdomain Finder - All Subdomains via CT Logs + Live DNS OpenAPI definition

Subdomain Finder - All Subdomains via CT Logs + Live DNS API

RAG Web Browser

apify/rag-web-browser

Web search and fetch tool for AI agents and RAG pipelines. It queries Google Search, scrapes the top N pages using a full web browser, and returns their content as clean Markdown for further processing by an LLM. Can also fetch individual URLs.

Apify

210K

4.7

(35)

Subdomain Finder

happitap/subdomain-finder

Subdomain Finder is a high-speed intelligence tool that uncovers subdomains for any target domain using Certificate Transparency (CT) logs. Unlike traditional brute-force tools, it requires no heavy traffic and provides results in seconds.

HappiTap

Instagram Scraper

apify/instagram-scraper

Extract Instagram posts, reels, profiles, places, hashtags, carousels, and comments. Get data from Instagram using one or more Instagram URLs or search queries: content, context, metrics, metadata. Export scraped data, run the scraper via API, schedule and monitor runs or integrate with other tools.

Apify

469K

4.7

(605)

Real Subdomain Finder

onescales/real-subdomain-finder

Discover every subdomain for any domain. Queries 40+ OSINT sources including cert transparency, DNS archives & web scanners. Results enriched with DNS validation, HTTP probing, and subdomain takeover detection. Simple Subdomain Lookup that works!

One Scales

124

5.0

(5)

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

Andok

Subdomain Finder - Discover Every Subdomain Of A Domain

thirdwatch/subdomain-finder

Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.

Thirdwatch

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Logiover

Website Color Palette Extractor - Hex Colors from URL

eliai/webpage-color-palette

Extracts a website's color palette from one URL or a bulk list, reading the page and the stylesheets it loads. Returns up to 20 hex and rgb colors ranked by frequency; failed fetches are never charged. For designers, brand managers, developers and agencies.

Broke to Built

PDF to Text Extractor with OCR — Scanned & Digital PDF API

eliai/pdf-text-extractor

Extracts text from PDF files by URL: digital PDFs keep their text layer, scanned pages are read with OCR. Returns the full text, page count and metadata (title, author, ISO dates) as JSON. Failed URLs are never charged. For RAG engineers, agent builders and legal researchers.

Broke to Built

Organization Registered Domain & Subdomain Scraper

lofomachines/organization-registered-domain-subdomain-scraper

Discover all domains registered by any organization by company domain. Find related domains, subdomains, registration dates, expiration dates, and registrar information. Perfect for brand protection, competitive analysis, M&A due diligence, and security research.