theHarvester Domain OSINT — Subdomains, Hosts, IPs & Emails

Run theHarvester — the standard open-source OSINT tool — on any domain, with zero setup and no API keys. Discover subdomains, hosts, IPs and emails gathered from free public sources.

Built for security recon, attack-surface mapping, penetration testing (authorized), and due diligence.

This Actor wraps the open-source theHarvester (GPL-2.0) and is not affiliated with the original project. It queries only free, key-free public sources. Use only on domains you own or are authorized to investigate. Comply with GDPR, PIPA, CCPA and applicable laws.

Free plan vs paid plan

	Free Apify plan	Paid Apify plan
Domains checked per run	The first 3	Up to 10
Findings returned per run	25 — one host, one IP and one email first	Every finding the sources return
Domain summary (counts per domain)	Yes, for the domains checked	Yes, for every domain
What stayed locked	Counted in the final free-plan-preview row: findings held back by type, domains not checked, estimated paid price	Nothing locked
Price per event	List price	Discounted: Bronze −20%, Silver −35%, Gold and above −48%

The free limit is a plan limit, not an error: the run finishes SUCCEEDED and the status message says how much stayed locked.

Why this Actor

• theHarvester, zero setup — no install, no API keys, no config
• Free public sources — crt.sh, Certspotter, HackerTarget, DuckDuckGo, and more
• Subdomain & host discovery — map a domain's public footprint fast
• Bulk — up to 10 domains per run
• One row per finding — each host, IP and email is a separate, de-duplicated dataset row
• Pay per event — a small fee per run plus a small fee per finding delivered, and a per-domain check fee when domain-checked is on the run's price list (charged for every domain whose lookup completes, even if nothing is found). No subscription.

Input

Field	Type	Description
domains	array	Up to 10 bare domains (e.g. example.com)
domain	string	Single-domain alternative
sources	array	Free sources to query (default: crtsh, certspotter, hackertarget). Key-requiring sources are intentionally excluded.
limit	integer	Max results per source (default 200)

{
  "domains": ["example.com"],
  "sources": ["crtsh", "certspotter", "hackertarget"],
  "limit": 200
}

Invalid input ends the run as SUCCEEDED with a notice row; the run-start fee is still charged.

Output

One dataset row per finding. Each discovered host, IP or email is its own row:

{ "domain": "example.com", "findingType": "host", "value": "mail.example.com",
  "source": "crtsh,certspotter,hackertarget", "scannedAt": "2026-08-25T02:43:13Z" }

findingType is one of host, ip or email.

After each domain, a summary row carries the totals. It is the answer for that domain — for a domain with nothing to find it is the only row — and it is charged as domain-checked when that event is on the run's price list (see Pricing):

{ "domain": "example.com", "noticeCode": "summary",
  "hostCount": 53, "ipCount": 50, "emailCount": 0, "findingsDelivered": 53,
  "sourcesUsed": ["crtsh","certspotter","hackertarget"],
  "message": "53 hosts, 50 IPs, 0 emails discovered for example.com." }

Rows carrying the noticeCode harvest-error, free-plan-preview, charge-limit-reached or billing-unavailable are messages, not results, and are never charged. The summary row is charged only as described under Pricing.

A note on emails

Emails are only produced by search-engine sources. Among the free sources here, duckduckgo is the one that returns emails — add it to sources if you need them. The default sources (crtsh, certspotter, hackertarget) are certificate/DNS sources and return subdomains and IPs only, so emailCount will be 0 with the defaults.

Pricing

Apify platform usage is included in these prices.

Event	Charged when	Free plan	Bronze	Silver	Gold and above
run-started	Once per run, including a run whose input is rejected	$0.005	$0.004	$0.00325	$0.0026
domain-checked	Once per domain whose lookup completed, for its summary row, including when no host, IP or email was found. Not charged when the lookup failed or timed out on our side, or when every source failed to answer. Applies when this event is on the run's price list.	$0.05	$0.04	$0.0325	$0.026
finding-delivered	For each host, IP or email returned	$0.005	$0.004	$0.00325	$0.0026

What "completed" means for domain-checked: theHarvester ran the sources for that domain and returned its result. A domain that ends in a harvest-error notice (engine error or timeout) is not charged, and neither is a domain for which every requested source reported a failure and nothing was found — its summary row is then delivered free. A source that rate-limits or returns partial data does not cancel the fee. Before the first lookup, the run's log and status message state the most the check fee can come to (number of domains × the per-domain price for your plan). Runs whose price list does not carry domain-checked are charged exactly as before: the summary row is free.

Example at Free-plan prices with domain-checked on the price list: one domain with 7 findings costs $0.005 + $0.05 + 7 × $0.005 = $0.09; one domain with nothing to find costs $0.005 + $0.05 = $0.055.

Other notice rows are never charged.

Maximum charge per run: each finding (and each billable summary row) is handed over and then charged, one at a time. When the run reaches the maximum charge you set, it hands over nothing more, adds a charge-limit-reached notice row (never charged) counting the findings and domains left, and finishes SUCCEEDED. If the Apify charging API itself stops answering (three charge calls failing in a row, or ten in one run), the run likewise stops early with a billing-unavailable notice row (never charged) rather than return rows it cannot bill; run again for the rest.

Free plan: each run checks the first 3 domains and returns up to 25 findings — one host, one IP and one email first, then the rest — plus each checked domain's summary row. Every free-plan run ends with a free-plan-preview notice row (never charged) counting the findings held back by type and the domains not checked, with an estimated paid price for the whole input. Paid Apify plans return every finding for up to 10 domains.

Use cases

• Attack-surface mapping — enumerate subdomains and hosts of an in-scope target
• Security recon — initial footprinting phase of an authorized engagement
• M&A / vendor due diligence — understand a company's external infrastructure
• Brand monitoring — track subdomains appearing in public sources

A note on sources

Sources that require paid/registered API keys (Shodan, Hunter, IntelX, Brave, Censys, etc.) are not included — this Actor is designed to work out of the box with free sources only. Some sources may rate-limit or return partial data; a domain whose lookup fails is reported in a harvest-error notice row.

Disclaimer

This Actor is an independent, unofficial tool, not affiliated with or endorsed by theHarvester, crt.sh, Certspotter, HackerTarget or DuckDuckGo. It reads only publicly accessible OSINT sources, without logging in. For informational and authorized security purposes only. Not legal advice. Results come from public sources and may contain false positives. You are responsible for complying with the target domain's terms of service and with privacy law (GDPR, CCPA, PIPA and others) in your jurisdiction, and you are the data controller for any personal data (emails) returned by a run you start. The operator is not responsible for misuse or for decisions made from these results.

Works well with

• subfinder-osint — Go deeper on the same domain with a dedicated subdomain engine.
• phone-number-validator-bulk — Validate the phone numbers harvested here in bulk — line type, carrier and reachability.
• socialscan-osint — Check the harvested emails for account existence across major platforms.

Every run of this Actor also returns these suggestions in the nextSteps field of its summary row.

Leave a review

A short review on the Reviews tab, good or bad, helps other people find this Actor and tells us what to build next. Found a bug or need a feature? Open an issue on the Issues tab and we'll look into it.