# theHarvester Domain OSINT - Subdomains, Hosts & Emails (`ntriqpro/theharvester-osint`) Actor Run theHarvester (the standard open-source OSINT tool) on any domain: discover subdomains, hosts, IPs and emails from free public sources (crt.sh, Certspotter, HackerTarget, DuckDuckGo). For recon, attack-surface mapping and due diligence. - **URL**: https://apify.com/ntriqpro/theharvester-osint.md - **Developed by:** [daehwan kim](https://apify.com/ntriqpro) (community) - **Categories:** Developer tools, Business - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing $50.00 / 1,000 domain harvesteds This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## theHarvester Domain OSINT — Subdomains, Hosts, IPs & Emails Run **[theHarvester](https://github.com/laramies/theHarvester)** — the standard open-source OSINT tool — on any domain, with **zero setup and no API keys**. Discover subdomains, hosts, IPs and emails gathered from free public sources. Built for **security recon, attack-surface mapping, penetration testing (authorized), and due diligence**. > This Actor wraps the open-source theHarvester (GPL-2.0) and is not affiliated with the original project. It queries **only free, key-free public sources**. Use only on domains you own or are authorized to investigate. Comply with GDPR, PIPA, CCPA and applicable laws. ### Why this Actor - **theHarvester, zero setup** — no install, no API keys, no config - **Free public sources** — crt.sh, Certspotter, HackerTarget, DuckDuckGo, and more - **Subdomain & host discovery** — map a domain's public footprint fast - **Bulk** — up to 10 domains per run - **Structured JSON** — hosts, IPs, emails separated and de-duplicated - **Pay per result** — $0.05 per domain investigated. No subscription. ### Input | Field | Type | Description | |---|---|---| | `domains` | array | Up to 10 bare domains (e.g. `example.com`) | | `domain` | string | Single-domain alternative | | `sources` | array | Free sources to query (default: crtsh, certspotter, hackertarget). Key-requiring sources are intentionally excluded. | | `limit` | integer | Max results per source (default 200) | ```json { "domains": ["example.com"], "sources": ["crtsh", "certspotter", "hackertarget"], "limit": 200 } ```` ### Output One dataset item per domain: `domain`, `hostCount`, `ipCount`, `emailCount`, `hosts`, `ips`, `emails`, `sourcesUsed`, `errors`, `scannedAt`. ### Use cases - **Attack-surface mapping** — enumerate subdomains and hosts of an in-scope target - **Security recon** — initial footprinting phase of an authorized engagement - **M\&A / vendor due diligence** — understand a company's external infrastructure - **Brand monitoring** — track subdomains appearing in public sources ### A note on sources Sources that require paid/registered API keys (Shodan, Hunter, IntelX, Brave, Censys, etc.) are **not** included — this Actor is designed to work out of the box with free sources only. Some sources may rate-limit or return partial data; errors are reported per run in the `errors` field. ### Disclaimer For informational and authorized security purposes only. Not legal advice. Results come from public sources and may contain false positives. The operator is not responsible for misuse or for decisions made from these results. # Actor input Schema ## `domains` (type: `array`): Domains to investigate (max 10). Enter bare domains like 'example.com'. theHarvester gathers OSINT for each. ## `domain` (type: `string`): Alternative single-domain input. Use 'domains' for batch. ## `sources` (type: `array`): Which free OSINT sources to query. Defaults are key-free and reliable. Sources requiring API keys are not supported here. ## `limit` (type: `integer`): Maximum results to pull per source. Default 200. ## Actor input object example ```json { "domains": [ "example.com" ], "sources": [ "crtsh", "certspotter", "hackertarget" ], "limit": 200 } ``` # Actor output Schema ## `dataset` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "example.com" ], "sources": [ "crtsh", "certspotter", "hackertarget" ], "limit": 200 }; // Run the Actor and wait for it to finish const run = await client.actor("ntriqpro/theharvester-osint").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": ["example.com"], "sources": [ "crtsh", "certspotter", "hackertarget", ], "limit": 200, } # Run the Actor and wait for it to finish run = client.actor("ntriqpro/theharvester-osint").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "example.com" ], "sources": [ "crtsh", "certspotter", "hackertarget" ], "limit": 200 }' | apify call ntriqpro/theharvester-osint --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=ntriqpro/theharvester-osint", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "theHarvester Domain OSINT - Subdomains, Hosts & Emails", "description": "Run theHarvester (the standard open-source OSINT tool) on any domain: discover subdomains, hosts, IPs and emails from free public sources (crt.sh, Certspotter, HackerTarget, DuckDuckGo). For recon, attack-surface mapping and due diligence.", "version": "1.0", "x-build-id": "nwTWfSE1zf6EOgFxB" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/ntriqpro~theharvester-osint/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-ntriqpro-theharvester-osint", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/ntriqpro~theharvester-osint/runs": { "post": { "operationId": "runs-sync-ntriqpro-theharvester-osint", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/ntriqpro~theharvester-osint/run-sync": { "post": { "operationId": "run-sync-ntriqpro-theharvester-osint", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "domains": { "title": "Domains", "maxItems": 10, "type": "array", "description": "Domains to investigate (max 10). Enter bare domains like 'example.com'. theHarvester gathers OSINT for each.", "items": { "type": "string" } }, "domain": { "title": "Single Domain (legacy)", "type": "string", "description": "Alternative single-domain input. Use 'domains' for batch." }, "sources": { "title": "Data sources (free, no API key)", "type": "array", "description": "Which free OSINT sources to query. Defaults are key-free and reliable. Sources requiring API keys are not supported here.", "items": { "type": "string", "enum": [ "crtsh", "certspotter", "hackertarget", "duckduckgo", "bing", "rapiddns", "sitedossier", "subdomaincenter", "subdomainfinderc99", "urlscan" ] } }, "limit": { "title": "Result limit per source", "minimum": 10, "maximum": 1000, "type": "integer", "description": "Maximum results to pull per source. Default 200." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```