Subdomain Finder

Discover invisible subdomains and detect Cloudflare protection instantly.

Subdomain Finder is a high-speed intelligence tool that uncovers subdomains for any target domain using Certificate Transparency (CT) logs. Unlike traditional brute-force tools, it requires no heavy traffic and provides results in seconds. It also automatically resolves IP addresses and detects if the subdomain is protected by Cloudflare.

What can Subdomain Finder do?

• ✅ Instant Discovery - Find subdomains in seconds using CT logs
• ✅ Infrastructure Mapping - Resolve IP addresses for every subdomain
• ✅ Cloudflare Detection - Identify which subdomains are behind Cloudflare proxy
• ✅ Security Recon - Find forgotten or shadow IT subdomains
• ✅ Export Formats - JSON, CSV, Excel ready

Why use Subdomain Finder?

Subdomain enumeration is a critical step in:

• Security Audits: Find exposed development, staging, or test environments.
• Competitor Analysis: Map out a competitor's infrastructure and service layout.
• Bug Bounty Hunting: Discover expanded attack surfaces.

Input

Field	Type	Description	Default
domain	string	The target root domain (e.g., rapidapi.com)	Required
resolveIps	boolean	Attempt to resolve IP addresses	true
detectCloudflare	boolean	Check for Cloudflare protection	true

Output

The Actor stores results in the default dataset and provides an aggregated JSON in the Key-Value store.

Output Example (JSON)

{
  "scan_date": "2023-12-09 23:43:11",
  "subdomains": [
    {
      "subdomain": "api.example.com",
      "ip": "172.67.1.1",
      "cloudflare": true
    },
    {
      "subdomain": "dev.example.com",
      "ip": "104.21.1.1",
      "cloudflare": true
    },
    {
      "subdomain": "legacy.example.com",
      "ip": "123.45.67.89",
      "cloudflare": false
    }
  ]
}

How much does it cost?

This Actor uses a Pay-Per-Event pricing model.

• Start Fee: $0.0001 per run
• Per Result: $0.0005 per unique subdomain found

Example: Scanning a domain with 100 subdomains costs approximately $0.05.

Is it legal?

Yes. This Actor uses Certificate Transparency (CT) logs, which are public records of issued SSL/TLS certificates. It does not perform invasive scanning or brute-forcing against the target infrastructure.