Pricing

from $0.05 / actor start

Try for free

Go to Apify Store

Real Subdomain Finder

Try for free

Discover every subdomain for any domain. Queries 40+ OSINT sources including cert transparency, DNS archives & web scanners. Results enriched with DNS validation, HTTP probing, and subdomain takeover detection. No API keys required.

Pricing

from $0.05 / actor start

Rating

5.0

(2)

Developer

One Scales

Actor stats

Bookmarked

Total users

Monthly active users

3 days ago

Last modified

Categories

Automation

Developer tools

Other

You can access the Real Subdomain Finder programmatically from your own applications by using the Apify API. You can also choose the language preference from below. To use the Apify API, you’ll need an Apify account and your API token, found in Integrations settings in Apify Console.

Python

JavaScript

CLI

OpenAPI

HTTP

MCP

1import { ApifyClient } from 'apify-client';
2
3// Initialize the ApifyClient with your Apify API token
4// Replace the '<YOUR_API_TOKEN>' with your token
5const client = new ApifyClient({
6    token: '<YOUR_API_TOKEN>',
7});
8
9// Prepare Actor input
10const input = {
11    "domains": [
12        "onescales.com"
13    ]
14};
15
16// Run the Actor and wait for it to finish
17const run = await client.actor("onescales/real-subdomain-finder").call(input);
18
19// Fetch and print Actor results from the run's dataset (if any)
20console.log('Results from dataset');
21console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
22const { items } = await client.dataset(run.defaultDatasetId).listItems();
23items.forEach((item) => {
24    console.dir(item);
25});
26
27// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

Real Subdomain Finder — Passive Subdomain Enumeration Tool API in JavaScript

The Apify API client for JavaScript is the official library that allows you to use Real Subdomain Finder API in JavaScript or TypeScript, providing convenience functions and automatic retries on errors.

Install the apify-client

$npm install apify-client

Other API clients include:

Real Subdomain Finder API in Python

Real Subdomain Finder API through CLI

Real Subdomain Finder OpenAPI definition

Real Subdomain Finder API

Subdomain Finder

happitap/subdomain-finder

Subdomain Finder is a high-speed intelligence tool that uncovers subdomains for any target domain using Certificate Transparency (CT) logs. Unlike traditional brute-force tools, it requires no heavy traffic and provides results in seconds.

HappiTap

Subdomain Finder

automation-lab/subdomain-finder

This actor discovers subdomains by querying certificate transparency logs via crt.sh. It finds all SSL/TLS certificates ever issued for a domain, extracting unique subdomain names. This passive reconnaissance technique requires no direct scanning.

Stas Persiianenko

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

Andok

Dns Lookup API

vivid_astronaut/dns-lookup

Fabio Suizu

Domain WHOIS & DNS Lookup â€” Registration, DNS Records & Tech

sovereigntaylor/domain-whois-scraper

Look up WHOIS data, DNS records, SSL certificates, and tech stack for any domain. Bulk domain research for lead generation, SEO audits, domain investing, and competitive intelligence. Uses RDAP, DNS-over-HTTPS, Certificate Transparency, and web WHOIS providers.

Ricardo Akiyoshi

Dns Lookup Actor

balathon/dns-lookup-actor

An Apify Actor that performs DNS lookups for given domain names and record types, with optional custom DNS server support.

Balasai Sigireddy

Email Validation API

gentle_cloud/email-validation-api

Validate email addresses with syntax checks, DNS MX record lookup, disposable email detection, and role-based address detection. No API key required.

Monkey Coder

Domain Checker - WHOIS & DNS

vivid_astronaut/domain-checker

Check domain availability, WHOIS records, DNS records, and SSL certificates. Supports bulk domain checking.

Fabio Suizu

DNS Records Lookup

nexgendata/dns-records-lookup

Query DNS records for any domain — A, AAAA, MX, NS, TXT, CNAME, SOA, and more. Essential for domain intelligence and security research.

Stephan Corbeil

Organization Registered Domain & Subdomain Scraper

lofomachines/organization-registered-domain-subdomain-scraper

Discover all domains registered by any organization by company domain. Find related domains, subdomains, registration dates, expiration dates, and registrar information. Perfect for brand protection, competitive analysis, M&A due diligence, and security research.