Pricing

from $26.00 / 1,000 domain scanneds

Try for free

Go to Apify Store

Subdomain Finder — Passive Enumeration & Discovery (Subfinder)

Try for free

Discover subdomains of any domain fast using the open-source Subfinder engine — passive enumeration from dozens of public sources (certificate transparency, DNS datasets, search engines). For attack-surface mapping and authorized security research.

Pricing

from $26.00 / 1,000 domain scanneds

Rating

0.0

(0)

Developer

daehwan kim

Actor stats

Bookmarked

Total users

Monthly active users

4 days ago

Last modified

Subdomain Finder — Passive OSINT Discovery Tool API through CLI

The Apify CLI is the official tool that allows you to use Subdomain Finder — Passive Enumeration & Discovery (Subfinder) locally, providing convenience functions and automatic retries on errors.

Install Apify CLI

Using installation script (macOS/Linux):

$curl -fsSL https://apify.com/install-cli.sh | bash

Using installation script (Windows):

$irm https://apify.com/install-cli.ps1 | iex

Using Homebrew:

$brew install apify-cli

Using npm:

$npm install -g apify-cli

Other API clients include:

Subdomain Finder — Passive Enumeration & Discovery (Subfinder) API in Python

Subdomain Finder — Passive Enumeration & Discovery (Subfinder) API in JavaScript

Subdomain Finder — Passive Enumeration & Discovery (Subfinder) OpenAPI definition

Subdomain Finder — Passive Enumeration & Discovery (Subfinder) API

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Logiover

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

Andok

Subdomain Radar — Passive OSINT Enumeration

saregaa/subdomain-scraper

Discover subdomains silently. No brute-force — pure OSINT from 5 passive sources with DNS resolve, HTTP probing & takeover detection.

Saregaa

Subdomain Enumeration via Certificate Transparency

perryay/subdomain-enumeration-ct-logs

Discover subdomains from Certificate Transparency logs using crt.sh and CertSpotter. Supports multi-source aggregation, deduplication, diff reporting, continuous monitoring, wildcard detection, and batch scanning — ideal for penetration testing, attack surface mapping, and security monitoring.

Perry AY

Certificate Transparency Scraper: Subdomain Discovery

arman-bd/certificate-transparency-scraper

Query certificate transparency logs via crt.sh to enumerate subdomains, issuers, validity windows and certificate history for any domain. Passive attack-surface discovery. no login, no proxy, no browser.

Arman Hossain

Domain Intelligence Scraper

romy/domain-intelligence-scraper

Domain Intelligence Scraper performs comprehensive passive OSINT on any domain — combining 8 free data sources into one output record: WHOIS, RDAP, DNS records, subdomains (from 3 independent sources), open ports + CVEs, passive DNS history, IP geolocation, and HTTP security headers

Romy

Subdomain Finder - CT Log Enumeration + Live DNS Check

eliai/subdomain-finder

Enumerate a domain's subdomains from Certificate Transparency logs, with an optional live DNS resolve. All subdomains in one record. $0.005 per domain (not per subdomain), far cheaper than paid finders; failures are free.

Broke to Built

Subdomain Finder – Certificate Transparency

datascraperes/crt-name-subdomain-finder

Find unique subdomains for up to 10,000 domains from live Certificate Transparency records. Normalize URLs, remove wildcard and duplicate hostnames, export structured results, and automate passive asset discovery through the Apify API.

DataScraperES

Subdomain Finder — Certificate Transparency (crt.sh)

bgfc97/crtsh-subdomain-finder

Discover subdomains of any domain from public Certificate Transparency logs (crt.sh). Attack-surface mapping and recon with first/last-seen dates. No key, no proxy.

Bruno

Certificate Transparency & Subdomain Discovery Scraper

scrapers_lat/certificate-transparency-scraper

Discover subdomains and SSL/TLS certificates for any domain from public certificate transparency logs. Extract SAN hostnames, issuer, validity dates, wildcard and expiry flags. Perfect for attack-surface mapping, OSINT and asset inventory. Export to JSON, CSV or Excel.