Subdomain Finder — Passive Subdomain Enumeration (Subfinder)

Discover all the subdomains of any domain, fast, using Subfinder (MIT) — the industry-standard passive subdomain enumeration engine by ProjectDiscovery. It pulls subdomains from dozens of public sources (certificate transparency logs, DNS datasets, search engines, threat-intel feeds) — no brute force, no port scanning, just fast passive discovery.

Built for security researchers, bug-bounty hunters, pentesters, and attack-surface-management teams who need to map a domain's footprint in seconds.

Legal notice: This Actor is an unofficial integration of subfinder (projectdiscovery/subfinder) and is not affiliated with or endorsed by ProjectDiscovery. It uses public passive data only. Enumerate only domains you own or are authorized to assess, and comply with all applicable laws.

What does this Actor do?

Give it a domain (e.g. example.com) and it returns every subdomain it can find from public passive sources — api.example.com, mail.example.com, staging.example.com, and so on — then resolves each one against public DNS so you know which hosts are actually live today and which are abandoned leftovers in the certificate logs.

It never authenticates, never bypasses a captcha, and never port-scans the target — every byte comes from a public passive source or a public DNS resolver. If the primary sources are unavailable, it automatically falls back to the public Cert Spotter certificate-transparency API, so a run comes back with data instead of coming back empty. Running on Apify adds scheduling, a REST API, dataset exports (JSON/CSV/Excel), and monitoring, so you can track a domain's growing attack surface over time.

Why use this Actor?

• Attack-surface mapping — see every public-facing subdomain an organization exposes.
• Bug bounty / pentest recon — the fastest first step of any engagement.
• Shadow-IT discovery — find forgotten staging, dev, and legacy hosts.
• Continuous monitoring — schedule scans and diff results to catch newly created subdomains.

How to use it

1. Enter a domain (example.com — no http://, no path).
2. Run it. Each unique subdomain becomes one dataset row, marked live or dead.
3. Export to CSV/JSON/Excel or pull via the API. Schedule for ongoing monitoring.

Input

Field	Type	Description
domain	string	Root domain to enumerate, e.g. example.com. Required.
resolveDns	boolean	Resolve every hostname against public DNS to confirm which are live (default true).
maxHosts	integer	Cap on hosts returned for the domain (default 500, max 2000).
timeout	integer	Max seconds for the passive enumeration step (default 180).

The pre-2.0 field name maxResults is still accepted as a synonym for maxHosts.

Output

Each unique subdomain is one dataset record. Download as JSON, HTML, CSV, or Excel.

{
  "domain": "apify.com",
  "subdomain": "api.apify.com",
  "isLive": true,
  "ipAddresses": ["52.72.98.171", "174.129.35.141"],
  "recordType": "A+AAAA",
  "source": "subfinder",
  "coverageDegraded": false,
  "scannedAt": "2026-08-13T00:00:00+00:00"
}

Field	Description
subdomain	The discovered hostname.
isLive	true when public DNS resolves the hostname right now.
ipAddresses	Every IP the hostname resolves to.
recordType	A, AAAA, or A+AAAA.
source	Which passive source produced the list — subfinder or certspotter.
coverageDegraded	true when only the Cert Spotter fallback was available, so the list is narrower than usual.

Pricing / Cost estimation

$0.05 per domain scanned, plus $0.003 per host confirmed live.

• The scan itself is billed once per domain, whether it finds four hosts or four hundred.
• Hosts that public DNS cannot resolve are free — you only pay for infrastructure that actually exists.
• An invalid domain, or a domain with nothing in the public logs, is not charged.

Cost examples: a small company domain with 4 live hosts costs $0.062. A large organization with 120 live hosts costs $0.41. Use maxHosts to cap your spend on very large targets. New Apify users get free monthly credits.

Free plan preview limit

Users on the Apify free plan get the first 25 hosts per run. The run still finishes successfully and tells you how many hosts were found in total — upgrade to a paid plan to export the full list.

Large scans and the run charge limit

Every Apify run has a maximum cost, which you set in the run's Run options. When a run reaches that limit, this Actor stops and finishes successfully with everything found so far, plus a final Charging limit reached record explaining what happened. You are never charged past your limit, and the run is not reported as a failure. To get the rest, raise the run's maximum cost or split the work across several runs.

Tips & advanced options

• Use maxHosts to control cost on large targets.
• Set resolveDns to false for a raw certificate-log dump — nothing is billed as a live host, but you also lose the live/dead verdict.
• Schedule weekly runs and diff the output to catch newly created subdomains (often staging/dev hosts that leak early).
• Pair with our dnstwist Actor (look-alike domains) and theHarvester Actor (emails/hosts) for full external recon.

FAQ, disclaimers & support

Is this legal? It performs passive enumeration from public data sources only — no brute force, no scanning of the target's servers. Use it for attack-surface mapping of domains you own or are authorized to assess.

Privacy & data responsibility. You are the data controller for every scan you run with this Actor; ntriqpro is a data processor acting solely on your instructions. You are responsible for having a lawful basis and a legitimate, purpose-limited reason for each scan, and for complying with GDPR, PIPA, CCPA, and other applicable privacy laws. We do not store your results — output is written only to your own run's dataset and is never retained on our side. Use this Actor only for lawful purposes and only on domains you own or are authorized to assess.

Known limitations: Passive sources have coverage gaps; some sources return more results with their own API keys. When the primary sources are down, the Cert Spotter fallback keeps the run alive but returns a narrower list — those results are flagged with coverageDegraded: true so you can re-run later for full coverage. Very large targets may hit the timeout (raise timeout or lower maxHosts).

• Found a bug or need a custom recon solution? Open an issue in the Issues tab.

---

🔗 Related Actors by ntriqpro

Build your full recon & OSINT stack:

• theharvester-osint — Emails, hosts & subdomains for a domain
• dnstwist-osint — Typosquatting & phishing domain detector
• gitleaks-secret-scanner — Leaked secrets in public repos
• maigret-actor — Username OSINT across 3000+ sites

⭐ Love it? Leave a Review

Your rating helps other researchers discover this Actor. Rate it here.