theHarvester OSINT: Hosts, Subdomains & Email

Collect a source-attributed public footprint for one authorized domain: in-scope subdomains and hostnames, public email addresses returned by selected providers, and optional passive IP observations. The dataset gives an agent or analyst one normalized row shape, while OUTPUT and RUN_SUMMARY make source coverage, limits, and terminal status explicit.

Best fit and workflow

Choose this Actor when you have a domain and want a bounded passive discovery pass before an asset inventory, exposure review, or authorized security assessment. It works well as the first step in a workflow that turns a domain into a review queue: collect findings here, verify ownership and reachability in your own process, then enrich only the assets that your authorization covers.

A practical scenario is a security team reviewing example.com after a rebrand. They run the default source groups, inspect hostname and email rows, use sources to repeat a provider-specific check, and keep RUN_SUMMARY beside the export so every row retains its discovery engine and collection time.

The runtime is intentionally a run-based dataset Actor rather than a Standby API. It accepts one domain per run, expands friendly capability tokens into an explicit passive allowlist, and uses the pinned upstream theHarvester JSONL result model. The upstream project describes passive P0 sources and the authorized-use boundary in its README.

Quick start

Run the default hostname, email, and passive-IP workflow:

{
  "domain": "example.com",
  "sources": ["subdomains", "emails"],
  "maxResults": 50,
  "perSourceLimit": 25,
  "sourceWorkers": 6,
  "includeIps": true,
  "startOffset": 0
}

From a terminal, call the private or public Actor by its canonical owner/slug:

curl -X POST "https://api.apify.com/v2/acts/khadinakbar~theharvester-osint/runs?token=$APIFY_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com","sources":["subdomains","emails"],"maxResults":20}'

Read the default dataset after the run:

$curl "https://api.apify.com/v2/datasets/$DATASET_ID/items?clean=true&format=json"

Input reference

Field	Default	Accepted range or values	Use
domain	required	One bare domain or HTTP(S) URL	Target scope, normalized to lowercase ASCII.
sources	subdomains, emails	Friendly groups or named passive providers	Expands into explicit P0 theHarvester sources.
maxResults	50	1–250	Total normalized dataset rows and maximum finding charges.
perSourceLimit	25	1–200	Provider-result bound for each selected source.
sourceWorkers	6	1–8	Concurrent passive provider jobs.
includeIps	true	Boolean	Includes IP rows when a selected passive source reports them.
startOffset	0	0–500	Pagination hint for providers that support offsets.

The source groups resolve as follows:

• subdomains: the curated passive hostname set.
• emails: the curated email-capable set.
• all-passive: the full curated P0 set.
• A named provider: one exact provider from the input schema allowlist.

This Actor does not accept API keys, cookies, passwords, proxy credentials, wildcard domains, IP targets, DNS brute force, recursive DNS, virtual-host probing, takeover checks, screenshots, or direct host interaction. Public provider availability varies by domain and time; source-level statuses remain in RUN_SUMMARY.

Output data

The default dataset contains one row per canonical finding. recordType is hostname, email, or ip; value is the universal lookup value; and the type-specific field makes filtering straightforward. Hostname rows are restricted to names below the target domain and carry isSubdomain: true.

Field	Meaning
recordType	Stable discriminator: hostname, email, or ip.
domain	Normalized target domain.
value	Canonical hostname, email, or IP address.
hostname, email, ipAddress	Type-specific convenience fields; other fields are null.
isSubdomain	true for hostname rows and null for email/IP rows.
sources, sourceCount	Providers that attributed the value.
provenance	Pinned engine/version, currently theHarvester 5.0.0.
discoveredAt	UTC normalization time.

Illustrative dataset row:

{
  "recordType": "hostname",
  "domain": "example.com",
  "value": "api.example.com",
  "hostname": "api.example.com",
  "email": null,
  "ipAddress": null,
  "isSubdomain": true,
  "sources": ["crtsh", "urlscan"],
  "sourceCount": 2,
  "provenance": "theHarvester 5.0.0",
  "discoveredAt": "2026-08-30T12:00:00Z"
}

OUTPUT contains the machine-readable terminal outcome, pushed item count, type counts, charge counts, and warnings. RUN_SUMMARY adds the expanded source list, upstream status, raw and filtered counts, duplicate count, per-source execution summaries, deadline state, and safe write diagnostics. The outcome values are COMPLETE, PARTIAL, VALID_EMPTY, INVALID_INPUT, UPSTREAM_FAILED, and CONFIG_ERROR.

Pricing

This Actor uses Apify Pay per event (PPE): $0.012 for each validated finding row persisted to the dataset, plus the platform usage charge shown by Apify. Apify also applies the configured synthetic Actor-start event of $0.00005. For example, a run capped at 20 persisted findings has a maximum finding-event charge of $0.24, plus the start event and platform usage; a source returning fewer rows costs less. Check the live Actor Pricing tab for the current configured price before running a paid job.

maxResults is the visible cost and output bound. A charge is attempted only after a row passes the Pydantic output contract and includes provider provenance. When Apify reports an event limit, the Actor stops adding rows and records PARTIAL with the charge-limit warning.

Best results and recovery

Start with the default capability groups for a broad passive view, then repeat with a smaller named source set when you need provider-level comparison. Keep perSourceLimit modest for a quick inventory and raise it when a domain has a larger public footprint. Use includeIps: false for a hostname/email-only export.

Provider results are observations rather than ownership proof. Combine the dataset with your authorized asset inventory, independently verify important findings, and retain RUN_SUMMARY with each export. A run with a completed source and zero accepted rows is reported as VALID_EMPTY; partial provider coverage, deadline coverage, or persistence coverage is reported as PARTIAL, so the next action is visible without treating an empty table as proof of absence.

MCP and AI-agent use

Connect the Actor through the Apify MCP configurator at mcp.apify.com and ask an agent for a bounded dataset job:

For the authorized domain example.com, collect passive subdomains and public emails with at most 50 findings, include IP observations, and return the dataset URL plus the OUTPUT and RUN_SUMMARY records. Summarize each finding’s source providers and collection time, and label partial or empty source coverage clearly.

The useful agent handoff is the dataset plus readback: filter recordType for hostnames or emails, group by sources, page through the dataset API, and inspect RUN_SUMMARY before using a finding in a downstream assessment. The Actor remains read-only with respect to target systems and does not receive provider credentials.

Focused standalone workflow

This Actor is designed as a focused standalone workflow for passive domain discovery. It produces a complete bounded handoff for the next authorized inventory or verification step, so a separate Actor link is unnecessary until a specific downstream enrichment job is selected.

Builder's note

I built this wrapper around the upstream transport-neutral execution API and its normalized JSONL result stream so the Apify dataset does not depend on scraping terminal text. I keep source selection explicit because the upstream project supports broader capability selectors, while this product contract is passive and bounded. The result model preserves provider attribution, and the Actor adds a second validation layer before any paid dataset write.

Responsible use

Run this Actor only for a domain you own or are authorized to assess. Respect applicable laws, provider policies, and site terms; treat public findings as leads for verification rather than proof of ownership, control, or vulnerability. The Actor is a passive discovery aid, not a substitute for authorization, asset inventory, or a security assessment.

Freshness and release evidence

The engine is pinned to reviewed upstream commit 903a35e118ccafccd750e9e1842055f01dc8b709; provider behavior, result availability, and pricing remain live external state. The deployed release log and cloud canary evidence are the source of truth for readiness. A local build or a successful process exit alone does not establish provider coverage or release readiness.