Subdomain Finder: Certificate Transparency + DNS Resolve avatar

Subdomain Finder: Certificate Transparency + DNS Resolve

Pricing

from $0.30 / 1,000 subdomain founds

Go to Apify Store
Subdomain Finder: Certificate Transparency + DNS Resolve

Subdomain Finder: Certificate Transparency + DNS Resolve

Find subdomains of any domain from public Certificate Transparency logs (crt.sh with Cert Spotter fallback) and resolve A/AAAA/CNAME to see which are live. Passive recon & asset discovery. $0.30 per 1,000 subdomains.

Pricing

from $0.30 / 1,000 subdomain founds

Rating

0.0

(0)

Developer

Andrew Shamah

Andrew Shamah

Maintained by Community

Actor stats

0

Bookmarked

2

Total users

1

Monthly active users

a day ago

Last modified

Security

Limited permissions

Share

Subdomain Finder – Certificate Transparency + DNS

Discover subdomains of any domain passively from public Certificate Transparency logs (crt.sh, with Cert Spotter as an automatic fallback), then resolve A / AAAA / CNAME to see which hosts are live. No brute force, no scanning of the target.

Use cases

Attack-surface mapping, bug-bounty recon on your own scope, IT asset inventory, finding forgotten staging hosts, competitor infrastructure research.

Input

{ "domains": ["example.com"], "resolveDns": true, "onlyResolving": false, "maxSubdomainsPerDomain": 0 }

Output (one item per subdomain)

{ "domain": "apify.com", "subdomain": "console.apify.com", "resolves": true, "a": ["104.18.x.x"], "cname": [], "certificates": 14, "firstSeen": "2019-03-01T00:00:00.000Z", "lastSeen": "2026-10-20T00:00:00.000Z", "source": "crt.sh" }

Pricing

$0.0003 per subdomain ($0.30 per 1,000) + tiny start fee. Use onlyResolving to pay only for live hosts, and maxSubdomainsPerDomain to cap cost.

Notes

crt.sh is a free community service and is sometimes slow; the Actor retries and falls back to Cert Spotter's free public API.

SEO & web suite

Documents suite

Jobs suite

Also by us