theHarvester Domain OSINT — Subdomains, Hosts, IPs & Emails

Run theHarvester — the standard open-source OSINT tool — on any domain, with zero setup and no API keys. Discover subdomains, hosts, IPs and emails gathered from free public sources.

Built for security recon, attack-surface mapping, penetration testing (authorized), and due diligence.

This Actor wraps the open-source theHarvester (GPL-2.0) and is not affiliated with the original project. It queries only free, key-free public sources. Use only on domains you own or are authorized to investigate. Comply with GDPR, PIPA, CCPA and applicable laws.

Why this Actor

• theHarvester, zero setup — no install, no API keys, no config
• Free public sources — crt.sh, Certspotter, HackerTarget, DuckDuckGo, and more
• Subdomain & host discovery — map a domain's public footprint fast
• Bulk — up to 10 domains per run
• One row per finding — each host, IP and email is a separate, de-duplicated dataset row
• Pay per result — a small fee per run plus a small fee per finding delivered. No subscription.

Input

Field	Type	Description
domains	array	Up to 10 bare domains (e.g. example.com)
domain	string	Single-domain alternative
sources	array	Free sources to query (default: crtsh, certspotter, hackertarget). Key-requiring sources are intentionally excluded.
limit	integer	Max results per source (default 200)

{
  "domains": ["example.com"],
  "sources": ["crtsh", "certspotter", "hackertarget"],
  "limit": 200
}

Invalid input ends the run as SUCCEEDED with a notice row.

Output

One dataset row per finding. Each discovered host, IP or email is its own row:

{ "domain": "example.com", "findingType": "host", "value": "mail.example.com",
  "source": "crtsh,certspotter,hackertarget", "scannedAt": "2026-08-25T02:43:13Z" }

findingType is one of host, ip or email.

After each domain, a summary row carries the totals and is not charged:

{ "domain": "example.com", "noticeCode": "summary",
  "hostCount": 53, "ipCount": 50, "emailCount": 0, "findingsDelivered": 53,
  "sourcesUsed": ["crtsh","certspotter","hackertarget"],
  "message": "53 hosts, 50 IPs, 0 emails discovered for example.com." }

Rows carrying a noticeCode (summary, harvest-error, free-plan-cap, charge-limit-reached) are messages, not results, and are never charged.

A note on emails

Emails are only produced by search-engine sources. Among the free sources here, duckduckgo is the one that returns emails — add it to sources if you need them. The default sources (crtsh, certspotter, hackertarget) are certificate/DNS sources and return subdomains and IPs only, so emailCount will be 0 with the defaults.

Pricing

• run-started — $0.005, charged once per run.
• finding-delivered — $0.005 for each host, IP or email returned.

Summary and notice rows are never charged. Free-plan runs return up to 25 findings per run, then stop cleanly with a free-plan-cap notice (upgrade your Apify plan for the full result set in one run).

Use cases

• Attack-surface mapping — enumerate subdomains and hosts of an in-scope target
• Security recon — initial footprinting phase of an authorized engagement
• M&A / vendor due diligence — understand a company's external infrastructure
• Brand monitoring — track subdomains appearing in public sources

A note on sources

Sources that require paid/registered API keys (Shodan, Hunter, IntelX, Brave, Censys, etc.) are not included — this Actor is designed to work out of the box with free sources only. Some sources may rate-limit or return partial data; errors are reported per run in the errors field.

Disclaimer

For informational and authorized security purposes only. Not legal advice. Results come from public sources and may contain false positives. The operator is not responsible for misuse or for decisions made from these results.

Works well with

• subfinder-osint — Go deeper on the same domain with a dedicated subdomain engine.
• phone-number-validator-bulk — Validate the phone numbers harvested here in bulk — line type, carrier and reachability.
• socialscan-osint — Check the harvested emails for account existence across major platforms.

Every run of this Actor also returns these suggestions in the nextSteps field of its summary row.