Pricing

$10.00 / 1,000 subdomain founds

Subdomain Finder — Passive Subdomain Enumeration (Subfinder)

Discover subdomains of any domain fast using the open-source Subfinder engine — passive enumeration from dozens of public sources (certificate transparency, DNS datasets, search engines). For attack-surface mapping and authorized security research.

Pricing

$10.00 / 1,000 subdomain founds

Rating

0.0

(0)

Developer

daehwan kim

Actor stats

Bookmarked

Total users

Monthly active users

5 days ago

Last modified

Categories

Developer tools

Business

You can access the Subdomain Finder — Passive Subdomain Enumeration (Subfinder) programmatically from your own applications by using the Apify API. You can also choose the language preference from below. To use the Apify API, you’ll need an Apify account and your API token, found in Integrations settings in Apify Console.

Python

JavaScript

CLI

OpenAPI

HTTP

MCP

1from apify_client import ApifyClient
2
3# Initialize the ApifyClient with your Apify API token
4# Replace '<YOUR_API_TOKEN>' with your token.
5client = ApifyClient("<YOUR_API_TOKEN>")
6
7# Prepare the Actor input
8run_input = {
9    "domain": "example.com",
10    "maxResults": 500,
11    "timeout": 180,
12}
13
14# Run the Actor and wait for it to finish
15run = client.actor("ntriqpro/subfinder-osint").call(run_input=run_input)
16
17# Fetch and print Actor results from the run's dataset (if there are any)
18print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
19for item in client.dataset(run["defaultDatasetId"]).iterate_items():
20    print(item)
21
22# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

Subdomain Finder — Passive Subdomain Enumeration (Subfinder) API in Python

The Apify API client for Python is the official library that allows you to use Subdomain Finder — Passive Subdomain Enumeration (Subfinder) API in Python, providing convenience functions and automatic retries on errors.

Install the apify-client

$pip install apify-client

Other API clients include:

Subdomain Finder — Passive Subdomain Enumeration (Subfinder) API in JavaScript

Subdomain Finder — Passive Subdomain Enumeration (Subfinder) API through CLI

Subdomain Finder — Passive Subdomain Enumeration (Subfinder) OpenAPI definition

Subdomain Finder — Passive Subdomain Enumeration (Subfinder) API

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Logiover

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

Andok

Attack Surface Recon: Subdomain Discovery + HTTP Fingerprint

advx/attack-surface-recon

Map a domain's external attack surface. Passive subdomain enumeration with subfinder, HTTP fingerprint with httpx: status, title, server, technology stack, TLS issuer and IP. One dataset row per responding host. For recon, asset discovery and security audits.

Sevastian Z

Subdomain Radar — Passive OSINT Enumeration

saregaa/subdomain-scraper

Discover subdomains silently. No brute-force — pure OSINT from 5 passive sources with DNS resolve, HTTP probing & takeover detection.

Saregaa

Certificate Transparency Subdomain Search (crt.sh alternative)

advx/ct-domain-lookup

Find subdomains and TLS certificates for any domain from Certificate Transparency logs. A fast, working crt.sh alternative for subdomain enumeration, recon and attack-surface mapping. Returns unique hostnames with first/last seen and issuers, or raw certificates.

Sevastian Z

Subdomain Finder - Discover Every Subdomain Of A Domain

thirdwatch/subdomain-finder

Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.

Thirdwatch

Subdomain Discovery API

crawland/subdomain-discovery-api

Paginated subdomain enumeration for any registered domain — DNS records, registrar, WHOIS, vendor reputation, and category labels per subdomain, served from the Crawland threat-intelligence backend.

Crawland

Real Subdomain Finder

onescales/real-subdomain-finder

Discover every subdomain for any domain. Queries 40+ OSINT sources including cert transparency, DNS archives & web scanners. Results enriched with DNS validation, HTTP probing, and subdomain takeover detection. Simple Subdomain Lookup that works!

One Scales

5.0

Subdomains Finder API - Realtime DNS Subdomain Scanner

dev00/subdomains-finder-api-realtime-dns-subdomain-scanner

High-performance subdomain scanner that retrieves all registered subdomains, IP addresses, and Cloudflare protection status for any given domain.

dev00

Subdomain Finder

happitap/subdomain-finder

Subdomain Finder is a high-speed intelligence tool that uncovers subdomains for any target domain using Certificate Transparency (CT) logs. Unlike traditional brute-force tools, it requires no heavy traffic and provides results in seconds.