# Subdomain Finder — Certificate Transparency Subdomain Scanner (`intelscrape/subdomain-finder`) Actor

Subdomain Finder: discover every subdomain of a domain from public certificate transparency logs (crt.sh, Cert Spotter), with first/last seen dates, issuers, live DNS (IPs, CNAMEs, hosting provider) and dangling-CNAME and dev/staging flags. Bulk domains. No API key. Pay per subdomain.

- **URL**: https://apify.com/intelscrape/subdomain-finder.md
- **Developed by:** [IntelScrape](https://apify.com/intelscrape) (community)
- **Categories:** Developer tools, SEO tools, Lead generation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Subdomain Finder — Certificate Transparency Subdomain Scanner

![Subdomain Finder — Certificate Transparency Subdomain Scanner](https://api.apify.com/v2/key-value-stores/hRabN9WfDGrT4nSvV/records/subdomain-finder-banner.png)

🇨🇳 **子域名查找器**：从公开的证书透明度日志（crt.sh、Cert Spotter）中发现一个域名的所有子域名，包括首次/最近出现时间、签发机构，以及实时 DNS（IP、CNAME、托管服务商）、悬空 CNAME 风险和开发/测试环境标记。支持批量域名，无需 API 密钥，按子域名付费。

🇸🇬 **Pencari Subdomain**: temui setiap subdomain sesuatu domain daripada log ketelusan sijil awam (crt.sh, Cert Spotter), dengan tarikh, penerbit, DNS langsung, penyedia hosting dan bendera risiko. Tiada kunci API.

#### 🤖 NEW: Connect This To Your AI!

Use this actor from Claude, ChatGPT, Cursor or any MCP client through the **[IntelScrape MCP Server](https://apify.com/intelscrape/skip--trace)**, or call it directly over the Apify API.

#### 🏆 Featured Bots by IntelScrape

- [Skip Trace Pro](https://apify.com/intelscrape/skip-trace-pro)
- [TruePeopleSearch Scraper](https://apify.com/intelscrape/truepeoplesearch-scraper)
- [TikTok Email Scraper](https://apify.com/intelscrape/tiktok-scraper)
- [Amazon Product Reviews Scraper](https://apify.com/intelscrape/amazon-product-review-scraper)
- [Website Contact Scraper](https://apify.com/intelscrape/contact-info-scraper)
- [Skip Trace MCP Server](https://apify.com/intelscrape/skip--trace)

⚡ Works with n8n, Make, Zapier, Google Sheets and the Apify API.

![price](https://img.shields.io/badge/price-%241%20per%201K%20subdomains-blue) ![billing](https://img.shields.io/badge/billing-pay%20per%20subdomain-green) ![API key](https://img.shields.io/badge/API%20key-not%20required-brightgreen) ![method](https://img.shields.io/badge/method-passive-orange)

**Passive subdomain discovery from certificate transparency logs with live DNS, hosting provider and takeover-risk flags.**

> **Honest coverage & billing:** Passive only: hosts without public certificates are invisible. You pay only for results actually delivered, and a built-in cost guard stops the run at your max-charge limit.

🌍 Built for teams in the **US, China and Singapore**, and anyone who needs this data in a spreadsheet or pipeline.

⭐ Found it useful? Please leave a review; it helps others find it.

⚖️ **Lawful business use only.** Collect public data only, and comply with the source site's terms, copyright and data-protection laws (GDPR, CCPA, China PIPL, Singapore PDPA).

*Examples below are illustrative; names and values may be fictional or out of date.*

### What is Subdomain Finder?

Every HTTPS certificate issued today is written to public certificate transparency logs, and each certificate lists the hostnames it covers. That makes CT logs the most complete passive source of subdomains there is: staging servers, admin panels, regional sites, SaaS integrations and forgotten marketing pages all show up. **Subdomain Finder** searches those logs, de-duplicates every hostname, and checks each one live in DNS so you know what is still running, where it is hosted and which CNAMEs are dangling.

### What does it do?

- **Certificate transparency search** on crt.sh with automatic fallback to Cert Spotter
- **De-duplicated hostnames** with certificate count, first and last seen dates, latest expiry, issuers and wildcard flag
- **Live DNS (on by default)**: resolves?, A records, CNAME chain
- **Hosting provider** from CNAMEs: AWS, CloudFront, Azure, Google Cloud, Vercel, Netlify, Heroku, GitHub Pages, Shopify, Zendesk, HubSpot and more
- **Dangling CNAME flag**: CNAME points to a target that no longer exists (classic subdomain-takeover pattern)
- **Dev/admin flag** for staging, test, admin, VPN, Jenkins, Grafana-style names
- **Bulk**: up to 1,000 root domains per run

### Why choose us over cheaper scrapers?

- **Honest output**: limits are documented, missing data is labeled, never invented
- **Clean, consistent schema** ready for Excel, Sheets, BI tools or an LLM
- **No account risk**: no logins, no cookies, no API keys
- **Pay per result** with a built-in cost guard; no subscription, failed items are never charged
- **Fast and light**: no residential proxy, so runs finish in seconds and stay cheap
- **Maintained by IntelScrape** and fixed fast when the source changes

### Who is it for?

- **Attack-surface mapping** for security teams and bug bounty hunters (passive, no scanning)
- **Subdomain takeover checks** on your own estate
- **Competitive intelligence**: see which SaaS tools and regions a company runs
- **Lead generation**: find companies using Zendesk, HubSpot or Shopify by subdomain
- **Asset inventory and M\&A due diligence**
- **SEO**: find forgotten subdomains that leak duplicate content

### How to use it

#### In Apify Console (no code)

1. Click **Try for free** / **Start**. The form is prefilled with a working example.
2. Change the inputs (see examples below).
3. Click **Start**, then export the results as **JSON, CSV, Excel, XML or HTML**, or open them in Google Sheets.
4. Optional: **Schedule** the actor to run hourly, daily or weekly.

#### Via API

```bash
curl -X POST "https://api.apify.com/v2/acts/intelscrape~subdomain-finder/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["apify.com"], "maxSubdomainsPerDomain": 100, "resolveDns": true}'
```

Or use the official [Apify JavaScript](https://docs.apify.com/api/client/js/) and [Python](https://docs.apify.com/api/client/python/) clients:

```python
from apify_client import ApifyClient
client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("intelscrape/subdomain-finder").call(run_input={"domains": ["apify.com"], "maxSubdomainsPerDomain": 100, "resolveDns": true})
for item in client.dataset(run["default_dataset_id"]).iterate_items():
    print(item)
```

#### With AI agents (MCP)

Add Apify's MCP server (`https://mcp.apify.com`) or the [IntelScrape MCP Server](https://apify.com/intelscrape/skip--trace) to Claude Desktop, Cursor, ChatGPT or any MCP client, then ask in plain language, e.g. *"Run intelscrape/subdomain-finder with the default input and summarise the results."*

### Input examples

**One domain, 100 most recent with DNS (default)**

```json
{
  "domains": ["apify.com"],
  "maxSubdomainsPerDomain": 100,
  "resolveDns": true
}
```

**Many domains, certificate data only**

```json
{
  "domains": ["stripe.com", "notion.so", "linear.app"],
  "maxSubdomainsPerDomain": 1000,
  "resolveDns": false
}
```

### Output fields

| Field | Description |
|---|---|
| `domain / subdomain / level` | Root domain, hostname and depth |
| `certCount / firstSeen / lastSeen / certValidUntil / hasValidCert` | Certificate history |
| `issuers / wildcardCert` | Certificate authorities and wildcard coverage |
| `resolves / ips / cnames` | Live DNS (when resolveDns is on) |
| `hostingProvider` | Detected from CNAMEs |
| `danglingCnameRisk` | CNAME exists but target does not resolve (NXDOMAIN) |
| `looksSensitive` | Name suggests dev, staging, admin or internal tooling |
| `source` | crt.sh or certspotter |

#### Sample output

```json
{
  "domain": "apify.com",
  "subdomain": "blog.apify.com",
  "level": 1,
  "certCount": 121,
  "lastSeen": "2026-09-26T09:27:42",
  "resolves": true,
  "ips": ["151.101.3.7", "151.101.67.7"],
  "cnames": ["apify.ghost.io", "ghost.map.fastly.net"],
  "hostingProvider": "Ghost",
  "danglingCnameRisk": false,
  "looksSensitive": false,
  "source": "crt.sh"
}
```

### Pricing (pay per event)

| Event | When it is charged | Price |
|---|---|---|
| **Actor start** | once per run | $0.005 |
| **Subdomain** | per unique subdomain row | $0.001 |
| **DNS resolve** | per subdomain checked live (on by default; turn off to skip) | $0.0005 |

#### Cost examples

| Run | Cost |
|---|---|
| Default run (apify.com: 36 subdomains with DNS) | $0.059 |
| 50 domains × 200 subdomains, no DNS | $10.005 |
| Monthly check of 1 domain, 1,000 subdomains with DNS | $1.505 |

Platform usage is included in these prices. Set **Max charge per run** in the run options to cap spend; the actor stops cleanly when the limit is reached and keeps everything collected so far.

### Tips for best results

- Set includeExpired to false for a current-only view.
- Filter danglingCnameRisk = true on your own domains and fix those records first.
- Turn off DNS to get the cheapest raw inventory.
- Very large domains (google.com) have millions of certificates; crt.sh may time out and the actor falls back to Cert Spotter, which returns a smaller recent window.

### FAQ

#### Is this active scanning?

No. It only reads public certificate logs and public DNS resolvers; nothing touches the target servers.

#### Will it find every subdomain?

It finds every hostname that has ever appeared on a publicly logged certificate. Hosts that never had a public certificate (internal-only, HTTP-only) cannot be found passively.

#### Why does a subdomain not resolve?

It may be retired, internal or behind split DNS. The certificate history still shows it existed.

#### What is dangling CNAME risk?

The subdomain points (CNAME) to a target that returns NXDOMAIN, the usual pre-condition for subdomain takeover. Verify manually; this is a flag, not proof.

#### Do I need an API key?

No.

#### Is failure charged?

No. If both certificate sources are down the domain is logged and not charged.

### Honest limits

- Passive only: hosts without public certificates are invisible.
- crt.sh is a free community service and can be slow or time out on huge domains.
- Wildcard certificates hide the individual hostnames they cover.
- Hosting detection uses CNAMEs; hosts on bare A records show no provider.

### Related IntelScrape bots

- [Tech Stack Detector](https://apify.com/intelscrape/tech-stack-detector): CMS, analytics & frameworks per domain
- [SPF DMARC Checker](https://apify.com/intelscrape/dns-email-security-checker): email security records per domain
- [WHOIS Domain Lookup](https://apify.com/intelscrape/whois-domain-lookup): registrar, dates & owner data
- [WordPress Theme & Plugin Detector](https://apify.com/intelscrape/wordpress-detector): themes, plugins & versions
- [Open Graph Scraper](https://apify.com/intelscrape/open-graph-scraper): link previews & meta tags
- [Skip Trace MCP Server](https://apify.com/intelscrape/skip--trace): IntelScrape tools for AI agents

### Legal

This actor collects publicly available data only. You are responsible for using the results lawfully and in line with the source's terms and applicable privacy laws (GDPR, CCPA, PIPL, PDPA). Process personal data only with a legitimate purpose. IntelScrape is not affiliated with, endorsed by or sponsored by the data source; all trademarks belong to their owners.

# Actor input Schema

## `domains` (type: `array`):

Root domains, one per line (URLs and emails are accepted and cleaned).

## `maxSubdomainsPerDomain` (type: `integer`):

Most recently certified first.

## `includeExpired` (type: `boolean`):

Turn off to keep only hosts with currently valid certificates in the log search.

## `resolveDns` (type: `boolean`):

Check each subdomain live: resolves?, IPs, CNAMEs, hosting provider and dangling-CNAME takeover risk. Charged per subdomain checked.

## `proxyConfiguration` (type: `object`):

Not needed normally. The actor switches to Apify Proxy automatically if the source starts rate-limiting.

## Actor input object example

```json
{
  "domains": [
    "apify.com"
  ],
  "maxSubdomainsPerDomain": 100,
  "includeExpired": true,
  "resolveDns": true,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com"
    ],
    "resolveDns": true
};

// Run the Actor and wait for it to finish
const run = await client.actor("intelscrape/subdomain-finder").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": ["apify.com"],
    "resolveDns": True,
}

# Run the Actor and wait for it to finish
run = client.actor("intelscrape/subdomain-finder").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com"
  ],
  "resolveDns": true
}' |
apify call intelscrape/subdomain-finder --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,intelscrape/subdomain-finder"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/SOmH6PccOw31dp0E1/builds/mWScYPQ5PlbbrTdm6/openapi.json