Pricing

from $0.72 / 1,000 subdomain returneds

Try for free

Go to Apify Store

Subdomain Finder: certificate transparency logs

Try for free

Finds the subdomains of any domain from certificate transparency logs (crt.sh), with first and last certificate dates, issuers, wildcard flags and current DNS addresses. No start fee; you pay per subdomain returned.

Pricing

from $0.72 / 1,000 subdomain returneds

Rating

0.0

(0)

Developer

Ed Rayyis

Actor stats

Bookmarked

Total users

Monthly active users

3 days ago

Last modified

Find the subdomains of a sample domain

Subdomain Finder

happitap/subdomain-finder

Subdomain Finder is a high-speed intelligence tool that uncovers subdomains for any target domain using Certificate Transparency (CT) logs. Unlike traditional brute-force tools, it requires no heavy traffic and provides results in seconds.

HappiTap

101

SSL Certificate Transparency Scraper (crt.sh)

chrisp1211/certificate-search-scraper-max

Scrape SSL/TLS certificate transparency logs from crt.sh for any domain. Great for security audits and subdomain discovery. Returns common name, subdomains (SANs), issuer and validity. Pay per certificate; empty runs free.

Christian Pichichero

Subdomain Finder & Reverse IP

canadesk/subdomain-finder-reverse-ip

Enumerate Subdomains and Reverse IPs with RapidDNS, Anubis, AlienVault and crt.sh! It's fast and costs little.

Canadesk Support

238

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

Andok

Subdomain Finder - Discover Every Subdomain Of A Domain

thirdwatch/subdomain-finder

Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.

Thirdwatch

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Logiover

Subdomain & Email Finder — Domain OSINT (theHarvester)

ntriqpro/theharvester-osint

Map the public attack surface of any domain: discover subdomains, hosts, IP addresses and emails from free public OSINT sources (crt.sh, Certspotter, HackerTarget, DuckDuckGo). Powered by theHarvester. No setup, no API keys — for recon, bug-bounty and due diligence.

Daniel Carter

Organization Registered Domain & Subdomain Scraper

lofomachines/organization-registered-domain-subdomain-scraper

Discover all domains registered by any organization by company domain. Find related domains, subdomains, registration dates, expiration dates, and registrar information. Perfect for brand protection, competitive analysis, M&A due diligence, and security research.

Lofomachines

Certificate Transparency & DNS Subdomain Inventory

thescrapelab/subdomain-intelligence-osint

Discover subdomains from public certificate tables, validate DNS and optionally profile public pages. Includes source coverage and reports without external provider APIs.

Inus Grobler

Subdomain Finder - All Subdomains via CT Logs + Live DNS

eliai/subdomain-finder

Finds a domain's subdomains from Certificate Transparency logs, with an optional live DNS check of each, for one domain or up to 100. Returns one record per domain with the deduplicated subdomains, which ones resolve and their IPs. For bug bounty hunters, pentesters and security teams.