Subdomain Finder — Passive Subdomain Enumeration (Subfinder)

Discover all the subdomains of any domain, fast, using Subfinder (MIT) — the industry-standard passive subdomain enumeration engine by ProjectDiscovery. It pulls subdomains from dozens of public sources (certificate transparency logs, DNS datasets, search engines, threat-intel feeds) — no brute force, no port scanning, just fast passive discovery.

Built for security researchers, bug-bounty hunters, pentesters, and attack-surface-management teams who need to map a domain's footprint in seconds.

Legal notice: This Actor is an unofficial integration of subfinder (projectdiscovery/subfinder) and is not affiliated with or endorsed by ProjectDiscovery. It uses public passive data only. Enumerate only domains you own or are authorized to assess, and comply with all applicable laws.

What does this Actor do?

Give it a domain (e.g. example.com) and it returns every subdomain it can find from public passive sources — api.example.com, mail.example.com, staging.example.com, and so on — each with the source that surfaced it. Running on Apify adds scheduling, a REST API, dataset exports (JSON/CSV/Excel), and monitoring, so you can track a domain's growing attack surface over time.

Why use this Actor?

• Attack-surface mapping — see every public-facing subdomain an organization exposes.
• Bug bounty / pentest recon — the fastest first step of any engagement.
• Shadow-IT discovery — find forgotten staging, dev, and legacy hosts.
• Continuous monitoring — schedule scans and diff results to catch newly created subdomains.

How to use it

1. Enter a domain (example.com — no http://, no path).
2. Run it. Each unique subdomain becomes one dataset row.
3. Export to CSV/JSON/Excel or pull via the API. Schedule for ongoing monitoring.

Input

Field	Type	Description
domain	string	Root domain to enumerate, e.g. example.com. Required.
maxResults	integer	Cap on subdomains returned/charged (default 500, max 2000).
timeout	integer	Max seconds for enumeration (default 180).

Output

Each unique subdomain is one dataset record. Download as JSON, HTML, CSV, or Excel.

{
  "domain": "example.com",
  "subdomain": "api.example.com",
  "source": "crtsh",
  "scannedAt": "2026-06-29T00:00:00+00:00"
}

Pricing / Cost estimation

Pay-per-result: $0.01 per unique subdomain discovered. A small site may return a handful of subdomains (a few cents); a large organization can return hundreds — use maxResults to cap your spend. No subdomains found = no charge. New Apify users get free monthly credits.

Tips & advanced options

• Use maxResults to control cost on large targets.
• Schedule weekly runs and diff the output to catch newly created subdomains (often staging/dev hosts that leak early).
• Pair with our dnstwist Actor (look-alike domains) and theHarvester Actor (emails/hosts) for full external recon.

FAQ, disclaimers & support

Is this legal? It performs passive enumeration from public data sources only — no brute force, no scanning of the target's servers. Use it for attack-surface mapping of domains you own or are authorized to assess.

Known limitations: Passive sources have coverage gaps; some sources return more results with their own API keys. Very large targets may hit the timeout (raise timeout or lower maxResults).

• Found a bug or need a custom recon solution? Open an issue in the Issues tab.

---

🔗 Related Actors by ntriqpro

Build your full recon & OSINT stack:

• theharvester-osint — Emails, hosts & subdomains for a domain
• dnstwist-osint — Typosquatting & phishing domain detector
• gitleaks-secret-scanner — Leaked secrets in public repos
• maigret-actor — Username OSINT across 3000+ sites

⭐ Love it? Leave a Review

Your rating helps other researchers discover this Actor. Rate it here.