# Subdomain Finder (`mina_safwat/subdomain-finder`) Actor

Finds every subdomain of a domain from public certificate transparency logs — thousands in under a second, without touching the target

- **URL**: https://apify.com/mina\_safwat/subdomain-finder.md
- **Developed by:** [Mina](https://apify.com/mina_safwat) (community)
- **Categories:** Developer tools, Other
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Subdomain Finder

Find every subdomain of a domain in about a second, from the public record of
TLS certificates.

Every certificate issued by a public authority is written to open logs, and
those logs name the hostnames each certificate covers. Reading them reveals a
domain's subdomains without sending a single request to the domain itself.

### How to use it

1. Put your domains into **Domains**, one per line.
2. Run the Actor.

Full URLs are fine — `https://www.example.com/pricing` is read as
`example.com`. If you enter something below the main domain, such as
`gist.github.com`, it is corrected up to `github.com` automatically and looked
up there.

### What you get

For every subdomain found:

- The full hostname
- The prefix in front of the main domain, on its own
- How many levels deep it sits
- Whether it is the main domain itself
- Whether it is a wildcard entry

Turn on **One row per domain** to get a single row per domain holding the
entire list instead. For a domain with tens of thousands of subdomains that is
far quicker to write and easier to hand to another tool.

### What you can do with it

- Map your own attack surface, including the hosts nobody remembered were there
- Find staging, development and admin hosts that were never meant to be public
- Check what a supplier or acquisition target exposes before signing
- Watch a domain over time by running on a schedule and comparing runs
- Feed the list into a port scanner, screenshotter or vulnerability checker

### Speed

One lookup answers a whole domain, so the lookups themselves are close to
instant — six domains holding 77,000 subdomains between them were fetched in
about a second in testing.

What actually takes time is writing the results. The same 77,000 subdomains
took 25 seconds to write as one row each, and **1.5 seconds** written as one
row per domain. If you are working at that scale, turn on **One row per
domain**.

If you are collecting from many domains at once, raise **Domains at a time**.
Ten is the default and works well; much higher rarely helps.

### Good to know

Very large domains — the likes of google.com — hold more certificates than this
service will return in one response, and are reported as such in the log rather
than failing the run. Looking up their individual subdomains works instead.

A domain with no certificates on record returns nothing. That is a real answer,
not an error: it means nothing has been publicly issued for it.

Certificate logs show what certificates *were issued for*, which is not the
same as what is running today. Some hosts will have been retired, and any host
that never had a public certificate will not appear at all.

### Is this legal?

Certificate transparency logs are public by design — they exist so anyone can
audit what certificates have been issued. This Actor only reads those published
logs and never contacts the domains it reports on. Use it on domains you own or
are authorised to assess.

### SEO Keywords

subdomain finder, subdomain enumeration, certificate transparency logs, passive dns recon, attack surface discovery, osint subdomain tool, domain reconnaissance, ct log search, security asset discovery, find subdomains of a domain

# Actor input Schema

## `domains` (type: `array`):

The domains to look up, one per line. Full URLs work too — https://www.example.com/page is read as example.com. If you enter something below the main domain, it is corrected upward automatically.

## `concurrency` (type: `integer`):

How many domains to look up simultaneously. Ten is a good balance; raising it much higher rarely helps.

## `max_subdomains_per_domain` (type: `integer`):

Stops after this many results for each domain. Leave at 0 to keep everything — some domains have tens of thousands.

## `one_row_per_domain` (type: `boolean`):

Return a single row per domain holding the whole list of subdomains, instead of one row each. Much faster to write when a domain has tens of thousands of them.

## Actor input object example

```json
{
  "domains": [
    "minaksa.com",
    "apify.com"
  ],
  "concurrency": 10,
  "max_subdomains_per_domain": 0,
  "one_row_per_domain": false
}
```

# Actor output Schema

## `dataset` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "minaksa.com",
        "apify.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("mina_safwat/subdomain-finder").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "minaksa.com",
        "apify.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("mina_safwat/subdomain-finder").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "minaksa.com",
    "apify.com"
  ]
}' |
apify call mina_safwat/subdomain-finder --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,mina_safwat/subdomain-finder"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/NQKh0wHN88KFdCoAG/builds/zP4AIxhX3ngz9d1V6/openapi.json