# Subdomain Finder — Passive Subdomain Enumeration (Subfinder) (`ntriqpro/subfinder-osint`) Actor Discover subdomains of any domain fast using the open-source Subfinder engine — passive enumeration from dozens of public sources (certificate transparency, DNS datasets, search engines). For attack-surface mapping and authorized security research. - **URL**: https://apify.com/ntriqpro/subfinder-osint.md - **Developed by:** [daehwan kim](https://apify.com/ntriqpro) (community) - **Categories:** Developer tools, Business - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing $10.00 / 1,000 subdomain founds This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Subdomain Finder — Passive Subdomain Enumeration (Subfinder) Discover **all the subdomains of any domain**, fast, using [Subfinder](https://github.com/projectdiscovery/subfinder) (MIT) — the industry-standard passive subdomain enumeration engine by ProjectDiscovery. It pulls subdomains from **dozens of public sources** (certificate transparency logs, DNS datasets, search engines, threat-intel feeds) — no brute force, no port scanning, just fast passive discovery. Built for **security researchers, bug-bounty hunters, pentesters, and attack-surface-management teams** who need to map a domain's footprint in seconds. > **Legal notice:** This Actor is an unofficial integration of subfinder (projectdiscovery/subfinder) and is not affiliated with or endorsed by ProjectDiscovery. It uses **public passive data only**. Enumerate only domains you own or are authorized to assess, and comply with all applicable laws. ### What does this Actor do? Give it a domain (e.g. `example.com`) and it returns every subdomain it can find from public passive sources — `api.example.com`, `mail.example.com`, `staging.example.com`, and so on — each with the source that surfaced it. Running on Apify adds scheduling, a REST API, dataset exports (JSON/CSV/Excel), and monitoring, so you can track a domain's growing attack surface over time. ### Why use this Actor? - **Attack-surface mapping** — see every public-facing subdomain an organization exposes. - **Bug bounty / pentest recon** — the fastest first step of any engagement. - **Shadow-IT discovery** — find forgotten staging, dev, and legacy hosts. - **Continuous monitoring** — schedule scans and diff results to catch newly created subdomains. ### How to use it 1. Enter a **domain** (`example.com` — no `http://`, no path). 2. Run it. Each unique subdomain becomes one dataset row. 3. Export to CSV/JSON/Excel or pull via the API. Schedule for ongoing monitoring. ### Input | Field | Type | Description | |---|---|---| | `domain` | string | Root domain to enumerate, e.g. `example.com`. **Required.** | | `maxResults` | integer | Cap on subdomains returned/charged (default 500, max 2000). | | `timeout` | integer | Max seconds for enumeration (default 180). | ### Output Each unique subdomain is one dataset record. Download as JSON, HTML, CSV, or Excel. ```json { "domain": "example.com", "subdomain": "api.example.com", "source": "crtsh", "scannedAt": "2026-06-29T00:00:00+00:00" } ```` ### Pricing / Cost estimation **Pay-per-result: $0.01 per unique subdomain discovered.** A small site may return a handful of subdomains (a few cents); a large organization can return hundreds — use `maxResults` to cap your spend. No subdomains found = no charge. New Apify users get free monthly credits. ### Tips & advanced options - Use `maxResults` to control cost on large targets. - Schedule weekly runs and diff the output to catch **newly created** subdomains (often staging/dev hosts that leak early). - Pair with our **dnstwist** Actor (look-alike domains) and **theHarvester** Actor (emails/hosts) for full external recon. ### FAQ, disclaimers & support **Is this legal?** It performs **passive** enumeration from public data sources only — no brute force, no scanning of the target's servers. Use it for attack-surface mapping of domains you own or are authorized to assess. **Known limitations:** Passive sources have coverage gaps; some sources return more results with their own API keys. Very large targets may hit the timeout (raise `timeout` or lower `maxResults`). - Found a bug or need a custom recon solution? Open an issue in the **Issues** tab. *** ### 🔗 Related Actors by ntriqpro Build your full recon & OSINT stack: - [**theharvester-osint**](https://apify.com/ntriqpro/theharvester-osint) — Emails, hosts & subdomains for a domain - [**dnstwist-osint**](https://apify.com/ntriqpro/dnstwist-osint) — Typosquatting & phishing domain detector - [**gitleaks-secret-scanner**](https://apify.com/ntriqpro/gitleaks-secret-scanner) — Leaked secrets in public repos - [**maigret-actor**](https://apify.com/ntriqpro/maigret-actor) — Username OSINT across 3000+ sites ### ⭐ Love it? Leave a Review Your rating helps other researchers discover this Actor. [Rate it here](https://apify.com/ntriqpro/subfinder-osint/reviews). # Actor input Schema ## `domain` (type: `string`): The root domain to enumerate subdomains for, e.g. example.com (no http://, no path). ## `maxResults` (type: `integer`): Maximum subdomains to return and charge for (hard cap 2000). ## `timeout` (type: `integer`): Maximum time for the enumeration. ## Actor input object example ```json { "domain": "example.com", "maxResults": 500, "timeout": 180 } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domain": "example.com", "maxResults": 500, "timeout": 180 }; // Run the Actor and wait for it to finish const run = await client.actor("ntriqpro/subfinder-osint").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domain": "example.com", "maxResults": 500, "timeout": 180, } # Run the Actor and wait for it to finish run = client.actor("ntriqpro/subfinder-osint").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domain": "example.com", "maxResults": 500, "timeout": 180 }' | apify call ntriqpro/subfinder-osint --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=ntriqpro/subfinder-osint", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Subdomain Finder — Passive Subdomain Enumeration (Subfinder)", "description": "Discover subdomains of any domain fast using the open-source Subfinder engine — passive enumeration from dozens of public sources (certificate transparency, DNS datasets, search engines). For attack-surface mapping and authorized security research.", "version": "1.0", "x-build-id": "z8ORjrY1vm278B4RR" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/ntriqpro~subfinder-osint/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-ntriqpro-subfinder-osint", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/ntriqpro~subfinder-osint/runs": { "post": { "operationId": "runs-sync-ntriqpro-subfinder-osint", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/ntriqpro~subfinder-osint/run-sync": { "post": { "operationId": "run-sync-ntriqpro-subfinder-osint", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "domain" ], "properties": { "domain": { "title": "Domain", "type": "string", "description": "The root domain to enumerate subdomains for, e.g. example.com (no http://, no path)." }, "maxResults": { "title": "Max subdomains", "minimum": 1, "maximum": 2000, "type": "integer", "description": "Maximum subdomains to return and charge for (hard cap 2000)." }, "timeout": { "title": "Timeout (seconds)", "minimum": 30, "maximum": 600, "type": "integer", "description": "Maximum time for the enumeration." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```