theHarvester Domain OSINT - Subdomains, Hosts & Emails
Pricing
$50.00 / 1,000 domain harvesteds
theHarvester Domain OSINT - Subdomains, Hosts & Emails
Run theHarvester (the standard open-source OSINT tool) on any domain: discover subdomains, hosts, IPs and emails from free public sources (crt.sh, Certspotter, HackerTarget, DuckDuckGo). For recon, attack-surface mapping and due diligence.
Pricing
$50.00 / 1,000 domain harvesteds
Rating
0.0
(0)
Developer
daehwan kim
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
20 hours ago
Last modified
Categories
Share
theHarvester Domain OSINT — Subdomains, Hosts, IPs & Emails
Run theHarvester — the standard open-source OSINT tool — on any domain, with zero setup and no API keys. Discover subdomains, hosts, IPs and emails gathered from free public sources.
Built for security recon, attack-surface mapping, penetration testing (authorized), and due diligence.
This Actor wraps the open-source theHarvester (GPL-2.0) and is not affiliated with the original project. It queries only free, key-free public sources. Use only on domains you own or are authorized to investigate. Comply with GDPR, PIPA, CCPA and applicable laws.
Why this Actor
- theHarvester, zero setup — no install, no API keys, no config
- Free public sources — crt.sh, Certspotter, HackerTarget, DuckDuckGo, and more
- Subdomain & host discovery — map a domain's public footprint fast
- Bulk — up to 10 domains per run
- Structured JSON — hosts, IPs, emails separated and de-duplicated
- Pay per result — $0.05 per domain investigated. No subscription.
Input
| Field | Type | Description |
|---|---|---|
domains | array | Up to 10 bare domains (e.g. example.com) |
domain | string | Single-domain alternative |
sources | array | Free sources to query (default: crtsh, certspotter, hackertarget). Key-requiring sources are intentionally excluded. |
limit | integer | Max results per source (default 200) |
Output
One dataset item per domain: domain, hostCount, ipCount, emailCount, hosts, ips, emails, sourcesUsed, errors, scannedAt.
Use cases
- Attack-surface mapping — enumerate subdomains and hosts of an in-scope target
- Security recon — initial footprinting phase of an authorized engagement
- M&A / vendor due diligence — understand a company's external infrastructure
- Brand monitoring — track subdomains appearing in public sources
A note on sources
Sources that require paid/registered API keys (Shodan, Hunter, IntelX, Brave, Censys, etc.) are not included — this Actor is designed to work out of the box with free sources only. Some sources may rate-limit or return partial data; errors are reported per run in the errors field.
Disclaimer
For informational and authorized security purposes only. Not legal advice. Results come from public sources and may contain false positives. The operator is not responsible for misuse or for decisions made from these results.
