Subdomain Finder — Passive Subdomain Enumeration (Subfinder)

Discover all the subdomains of any domain, fast, using Subfinder (MIT) — the industry-standard passive subdomain enumeration engine by ProjectDiscovery. It pulls subdomains from dozens of public sources (certificate transparency logs, DNS datasets, search engines, threat-intel feeds) — no brute force, no port scanning, just fast passive discovery.

Built for security researchers, bug-bounty hunters, pentesters, and attack-surface-management teams who need to map a domain's footprint in seconds.

Free plan vs paid plan

	Apify free plan	Any paid Apify plan
Host rows per run	25 (one of each DNS verdict kind included)	Every host up to maxHosts (default 500, max 2,000)
Live / dead DNS verdict	Yes, on the 25 rows shown	Yes, on every row
Locked hosts	Counted exactly in a final free-plan-preview row (locked hosts, locked live hosts, what a paid run returns, estimated cost)	Nothing locked
Price per event	List price	Bronze 20% off · Silver 35% off · Gold and above 48% off

Legal notice: This Actor is an unofficial integration of subfinder (projectdiscovery/subfinder) and is not affiliated with or endorsed by ProjectDiscovery. It uses public passive data only. Enumerate only domains you own or are authorized to assess, and comply with all applicable laws.

What does this Actor do?

Give it a domain (e.g. example.com) and it returns every subdomain it can find from public passive sources — api.example.com, mail.example.com, staging.example.com, and so on — then resolves each one against public DNS so you know which hosts are actually live today and which are abandoned leftovers in the certificate logs.

It never authenticates, never bypasses a captcha, and never port-scans the target — every byte comes from a public passive source or a public DNS resolver. If the primary sources are unavailable, it automatically falls back to the public Cert Spotter certificate-transparency API, so a run comes back with data instead of coming back empty. Running on Apify adds scheduling, a REST API, dataset exports (JSON/CSV/Excel), and monitoring, so you can track a domain's growing attack surface over time.

Why use this Actor?

• Attack-surface mapping — see every public-facing subdomain an organization exposes.
• Bug bounty / pentest recon — the fastest first step of any engagement.
• Shadow-IT discovery — find forgotten staging, dev, and legacy hosts.
• Continuous monitoring — schedule scans and diff results to catch newly created subdomains.

How to use it

1. Enter a domain (example.com — no http://, no path).
2. Run it. Each unique subdomain becomes one dataset row, marked live or dead.
3. Export to CSV/JSON/Excel or pull via the API. Schedule for ongoing monitoring.

Input

Field	Type	Description
domain	string	Root domain to enumerate, e.g. example.com. Required.
resolveDns	boolean	Resolve every hostname against public DNS to confirm which are live (default true).
maxHosts	integer	Cap on hosts returned for the domain (default 500, max 2000).
timeout	integer	Max seconds for the passive enumeration step (default 180).

The pre-2.0 field name maxResults is still accepted as a synonym for maxHosts.

Invalid input ends the run as SUCCEEDED with a notice row.

Output

Each unique subdomain is one dataset record. Download as JSON, HTML, CSV, or Excel.

{
  "domain": "apify.com",
  "subdomain": "api.apify.com",
  "isLive": true,
  "ipAddresses": ["52.72.98.171", "174.129.35.141"],
  "recordType": "A+AAAA",
  "source": "subfinder",
  "coverageDegraded": false,
  "scannedAt": "2026-08-13T00:00:00+00:00"
}

Field	Description
subdomain	The discovered hostname.
isLive	true when public DNS resolves the hostname right now.
ipAddresses	Every IP the hostname resolves to.
recordType	A, AAAA, or A+AAAA.
dnsStatus	resolved (live), no-record (DNS answered: no address), lookup-failed (the lookup did not finish, e.g. timeout), or not-checked (resolveDns off).
source	Which passive source produced the list — subfinder or certspotter.
coverageDegraded	true when only the Cert Spotter fallback was available, so the list is narrower than usual.

Pricing / Cost estimation

$0.05 per domain scanned, plus $0.003 per host confirmed live.

• The scan itself is billed once per domain, whether it finds four hosts or four hundred.
• host-checked ($0.003) — each delivered host row whose public DNS lookup completed and found no address record (a "not live" verdict). Billed only once this event appears on the Actor's price list; until then these rows stay free.
• host-discovered ($0.003) — each delivered host row when you turn resolveDns off (the hostname comes from the passive sources without a DNS lookup). Billed only once this event appears on the Actor's price list.
• A DNS lookup that timed out or failed on our side is never charged (dnsStatus: lookup-failed).
• An invalid input is not charged. A domain with nothing in the public logs is billed the scan fee only.
• Each billable row is delivered first and charged right after; when your run's maximum cost is reached the run stops before the next billable row.

Cost examples: a small company domain with 4 live hosts costs $0.062. A large organization with 120 live hosts costs $0.41. Use maxHosts to cap your spend on very large targets. New Apify users get free monthly credits.

Users on the Apify free plan get 25 host rows per run (live hosts first, with one of each DNS verdict kind). The run still finishes successfully and the last free-plan-preview row counts exactly how many hosts and live hosts were locked and what a paid run of the same input returns — upgrade to a paid plan to export the full list.

Large scans and the run charge limit

Every Apify run has a maximum cost, which you set in the run's Run options. When a run reaches that limit, this Actor stops and finishes successfully with everything found so far, plus a final Charging limit reached record explaining what happened. You are never charged past your limit, and the run is not reported as a failure. To get the rest, raise the run's maximum cost or split the work across several runs.

Tips & advanced options

• Use maxHosts to control cost on large targets.
• Set resolveDns to false for a raw certificate-log dump — rows are billed as host-discovered instead of live-host, and you lose the live/dead verdict.
• Schedule weekly runs and diff the output to catch newly created subdomains (often staging/dev hosts that leak early).
• Pair with our dnstwist Actor (look-alike domains) and theHarvester Actor (emails/hosts) for full external recon.

FAQ, disclaimers & support

Is this legal? It performs passive enumeration from public data sources only — no brute force, no scanning of the target's servers. Use it for attack-surface mapping of domains you own or are authorized to assess.

Privacy & data responsibility. You are the data controller for every scan you run with this Actor; ntriqpro is a data processor acting solely on your instructions. You are responsible for having a lawful basis and a legitimate, purpose-limited reason for each scan, and for complying with GDPR, PIPA, CCPA, and other applicable privacy laws. We do not store your results — output is written only to your own run's dataset and is never retained on our side. Use this Actor only for lawful purposes and only on domains you own or are authorized to assess.

Known limitations: Passive sources have coverage gaps; some sources return more results with their own API keys. When the primary sources are down, the Cert Spotter fallback keeps the run alive but returns a narrower list — those results are flagged with coverageDegraded: true so you can re-run later for full coverage. Very large targets may hit the timeout (raise timeout or lower maxHosts).

• Found a bug or need a custom recon solution? Open an issue in the Issues tab.

---

🔗 Related Actors by ntriqpro

Build your full recon & OSINT stack:

• theharvester-osint — Emails, hosts & subdomains for a domain
• dnstwist-osint — Typosquatting & phishing domain detector
• gitleaks-secret-scanner — Leaked secrets in public repos
• maigret-actor — Username OSINT across 3000+ sites

⭐ Love it? Leave a Review

Your rating helps other researchers discover this Actor. Rate it here.

Works well with

• dnstwist-osint — Find registered look-alike domains impersonating the domain you just mapped.
• whois-domain-lookup — Get registrar, age and registrant contact for any domain in this list.
• lighthouse-website-audit — Score the discovered hosts for performance, SEO and accessibility in one batch.

Every run of this Actor also returns these suggestions in the nextSteps field of its summary row.