# Subdomain Finder: Certificate Transparency Scan (`recordsdata/subdomain-finder-scraper`) Actor Find subdomains of any domain from Certificate Transparency (crt.sh) logs: hostnames, first and last seen, wildcard and valid-cert flags, issuer summary per domain. Export CSV, Excel, JSON. No login or API key. Example: mercadolibre.com returned 129 subdomains from 624 certificates. - **URL**: https://apify.com/recordsdata/subdomain-finder-scraper.md - **Developed by:** [RecordsData](https://apify.com/recordsdata) (community) - **Categories:** Developer tools, SEO tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $10.00 / 1,000 subdomains This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md. ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run. For examples already wired to this Actor's own input schema, see the [API](#api) section below. Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`). # README

RecordsData

## ๐Ÿ›ฐ Subdomain Finder: Certificate Transparency Scan > Subdomain Finder lists the subdomains of a domain from Certificate Transparency logs (crt.sh, with Cert Spotter failover), then optionally adds HackerTarget, RapidDNS and subdomain.center, DNS answers (IPs, CNAME, Cloudflare flag, wildcard-DNS detection), an HTTP probe (status, title, server) and a wordlist guess. One row per hostname with certificate history. Export CSV, Excel, JSON. No login or API key. $10 per 1,000 subdomains. Subdomain Finder is a subdomain enumeration tool that is passive by default: with the default settings it only reads public Certificate Transparency (CT) logs and never sends a packet to the target. Switch on `resolveIps`, `httpProbe` or `bruteForce` and it also asks DNS and the hosts themselves, so you can see which names resolve and which answer over HTTP. Built for security teams, in-scope bug bounty hunters and brand-protection analysts. ### ๐Ÿ” What does Subdomain Finder do? - Lists subdomains from Certificate Transparency logs, the same data behind crt.sh, with first and last seen dates, newest issuer and expiry date. - Adds passive sources with `sources`: `hackertarget`, `rapiddns` and `subdomaincenter` (default `["ct"]`). - Resolves hosts with `resolveIps`: A, AAAA, CNAME, `ipAddresses`, `dnsResolves` and a `behindCloudflare` flag. Wildcard DNS is flagged as `wildcardDnsMatch`. - Probes HTTP with `httpProbe`: `isAlive`, `httpStatus`, `httpTitle`, `httpServer` and more. - Guesses common names with `bruteForce` (`small` 59 or `medium` 311 names) using DNS lookups. - Summarizes each domain (certificates, unique and valid subdomains, top 5 issuers) and can export up to 200 raw certificate rows per domain. - Survives outages: crt.sh is retried inside 75 seconds, then Cert Spotter, then subdomain.center and RapidDNS (not with `onlyValidCerts`). ### ๐Ÿ“Š What data can you extract from Certificate Transparency logs? | Field | Row type | Description | |---|---|---| | `recordType` | all | `subdomain`, `domain-summary` or `certificate` | | `domain` | all | The root domain you asked for | | `subdomain` | subdomain | Hostname found by a source | | `isWildcard` | subdomain | `Yes` if the certificate name starts with `*.` | | `certCount` | subdomain | Number of certificates that cover the hostname (omitted when no CT source answered) | | `firstSeen`, `lastSeen` | subdomain | Earliest and latest certificate start dates | | `hasValidCert` | subdomain | `Yes`, `No`, or `Unknown` when no CT source answered | | `latestIssuer`, `certExpiresAt` | subdomain | Issuer organisation and expiry date of the newest certificate | | `dnsResolves`, `ipAddresses`, `cname`, `behindCloudflare`, `wildcardDnsMatch` | subdomain | DNS answer, Cloudflare range flag, catch-all match (with `resolveIps`) | | `isAlive`, `httpStatus`, `httpScheme`, `httpFinalUrl`, `httpTitle`, `httpServer`, `httpResponseMs`, `httpError` | subdomain | HTTP result with `httpProbe` | | `totalCertificates`, `uniqueSubdomains`, `validSubdomains`, `hasWildcardDns`, `topIssuers` | domain-summary | Counts for the domain, wildcard-DNS flag, top 5 issuers | | `crtshId`, `commonName`, `issuer`, `notBefore`, `notAfter`, `serialNumber`, `entryTimestamp` | certificate | Raw certificate fields | | `source`, `sources` | all | Which source answered, and every source that listed the host | | `crtshUrl`, `scrapedAt` | all | Link to crt.sh and run timestamp | ### ๐Ÿงพ Sample output of the subdomain scan On 2026-10-04 crt.sh returned 624 certificates and 129 unique subdomains (46 valid) for mercadolibre.com. When crt.sh is down, Cert Spotter lists only unexpired certificates, so counts are lower. The `source` column tells you which one answered. Real row from a cloud run on mercadolibre.com (2026-10-07, Cert Spotter fallback). It predates the DNS and HTTP columns, which are added with `resolveIps` and `httpProbe`. ```json { "recordType": "subdomain", "domain": "mercadolibre.com", "subdomain": "*.hom-proxy-urutec.mercadolibre.com", "isWildcard": "Yes", "certCount": 1, "firstSeen": "2026-04-30T00:00:00", "lastSeen": "2026-04-30T00:00:00", "hasValidCert": "Yes", "source": "certspotter", "scrapedAt": "2026-10-07T19:34:15.074Z" } ``` ### ๐Ÿ’ฐ How much does it cost to find subdomains? Pay per event, only for saved results. DNS, HTTP probe, extra sources and wordlist guess add columns at no extra cost. | Event | Price | What you get | |---|---|---| | Subdomain | $10.00 per 1,000 ($0.01 each) | One unique subdomain row, with DNS and HTTP columns when switched on | | Domain scan summary | $0.02 per domain | Totals and top issuers for one domain | | Certificate | $10.00 per 1,000 ($0.01 each) | One raw certificate row (off by default) | Worked examples: 1,000 subdomains of one domain cost 1,000 x $0.01 = $10.00, plus $0.02 for its summary = $10.02. Raw certificate rows add up to $2.00 per domain. Small run: `resolveIps` on, `maxItems` 5 and the default summary gave 1 summary + 4 hosts, about $0.06 (verified in cloud on 2026-10-10). Large run on microsoft.com with DNS, HTTP probe and medium wordlist: 599 subdomains + 1 summary = $6.01. Error rows, empty scans and failed runs are never billed, and the run stops at your max charge limit. ### ๐Ÿš€ How to find all subdomains of a domain (3 steps) 1. Open the actor and enter one or more root domains (up to 2,000), for example `apify.com`. 2. Set **Max Items** (default 10), pick sources and toggle the options you want. 3. Click **Start**, then download the dataset as CSV, Excel, JSON or XML. ### โš™๏ธ Input | Field | Type | Default | Description | |---|---|---|---| | `domains` | array | `["apify.com"]` | Root domains to scan, up to 2,000. URLs and `*.` prefixes are cleaned up | | `maxItems` | integer | `10` | Max rows and a cap on spend. Free: 10. Paid: up to 1,000,000 | | `sources` | array | `["ct"]` | `ct`, `hackertarget`, `rapiddns`, `subdomaincenter` | | `bruteForce` | string | `none` | `none`, `small` (59 names) or `medium` (311 names), DNS lookups, skipped with `onlyValidCerts` | | `onlyValidCerts` | boolean | `false` | Keep only hostnames with a non-expired certificate | | `includeWildcards` | boolean | `true` | Keep `*.` entries as their own rows | | `resolveIps` | boolean | `false` | Add A, AAAA, CNAME, `ipAddresses`, `behindCloudflare` | | `onlyResolving` | boolean | `false` | Drop hosts that do not resolve (turns DNS on) | | `skipWildcardDnsMatches` | boolean | `false` | Drop hosts that match the catch-all DNS answer (turns DNS on) | | `httpProbe` | boolean | `false` | Add status, title, server and redirect target | | `onlyAlive` | boolean | `false` | Keep only hosts that answer over HTTP (turns the probe on) | | `probeTimeoutSecs` | integer | `5` | Wait per HTTP attempt, 1 to 10 seconds | | `includeDomainSummary` | boolean | `true` | Add one summary row per domain (billed as its own event) | | `includeCertificates` | boolean | `false` | Add raw certificate rows (billed as its own event) | ```json { "domains": ["apify.com"], "resolveIps": true, "httpProbe": true, "includeDomainSummary": false, "maxItems": 5 } ``` ### ๐Ÿ“ฆ Output One dataset with three row types set by `recordType`, in four views. A domain with no certificates gives zero rows and no charge. If every source is down for every domain, or no domain is valid, the run fails with a clear message and no charge. Limits: no proxy for the HTTP probe (datacenter IPs, so some hosts time out; on microsoft.com 170 of 599 hosts answered), the probe reads only the first 32 KB, HackerTarget allows about 50 requests per day per IP, RapidDNS gives the first 100 rows free. There is no monitoring or only-new mode. ### โš–๏ธ Subdomain Finder vs other Apify subdomain actors Read on 2026-10-10 from the public Apify Store pages. | Dimension | This actor | thirdwatch | happitap and andok | |---|---|---|---| | Price | $10 per 1,000 + $0.02 summary | from $0.70 per 1,000 | happitap from $0.80; andok from $0.47 per domain scan | | Sources | CT with failover, HackerTarget, RapidDNS, subdomain.center | crt.sh, HackerTarget, RapidDNS, brute force | happitap not stated; andok crt.sh and brute force | | DNS and HTTP | IPs, CNAME, status, title, server | IPs, status, title, alive flag | happitap IP and Cloudflare flag; andok none shown | | Certificate history | counts, first and last seen, issuer, raw rows | not shown | not shown | logiover/subdomain-finder (from $3.50 per 1,000) returns crt.sh and Cert Spotter names with an optional DNS-over-HTTPS check. We are the most expensive of the five, by roughly 14x against thirdwatch. thirdwatch resolves DNS, probes HTTP and has brute force too, so for a plain live-host list it is the cheaper buy. The extra price here pays for certificate history per host, the valid-certificate flag, issuer analytics per domain, the Cloudflare flag and a failover chain. We show no monitoring mode, and neither does any rival page. ### ๐Ÿงฐ Use cases Attack surface management, in-scope bug bounty recon, asset inventory checks, brand protection and takeover triage through the `cname` field. ### ๐Ÿ”Œ Run via API, schedule and integrations ```bash curl -X POST "https://api.apify.com/v2/acts/RecordsData~subdomain-finder-scraper/runs?token=YOUR_TOKEN" \ -H "Content-Type: application/json" \ -d '{"domains":["example.com"],"resolveIps":true,"httpProbe":true,"maxItems":100}' ``` Use the apify-client for Python and JavaScript, schedule runs, or connect Make, Zapier and n8n. ### ๐Ÿค– Subdomain Finder MCP server for AI agents (Claude, Cursor, VS Code) Connect this actor to any MCP client through the Apify MCP server. Use this URL, which exposes only this actor as a tool: `https://mcp.apify.com?tools=RecordsData/subdomain-finder-scraper` Config for clients that take a JSON MCP config: ```json { "mcpServers": { "apify": { "url": "https://mcp.apify.com?tools=RecordsData/subdomain-finder-scraper" } } } ``` Example agent prompt: "Use the subdomain finder on example.com with resolveIps and httpProbe on, only valid certificates, then list the hosts that answer over HTTP, their IPs, and the subdomains first seen in the last 90 days." Tool description: use it when an agent needs subdomain enumeration for a domain it is authorized to assess: Certificate Transparency history, optional passive sources, DNS answers and an HTTP status check per host. It takes the same input as the actor; set `maxItems` to keep agent runs small and cheap. ### ๐Ÿ›ก๏ธ Is it legal to find subdomains with Certificate Transparency? Certificate Transparency logs are public by design, and default settings only read them. The optional DNS check, HTTP probe and wordlist guess contact DNS servers and the hosts (one GET per host). Scan only domains you own or are authorized to assess. ### โ“ Frequently asked questions #### How do I find all subdomains of a domain? Enter the root domain, for example `apify.com`, in the Subdomain Finder and click Start. It queries Certificate Transparency logs (crt.sh, with Cert Spotter as a fallback) and returns one row for every hostname that ever appeared on a public TLS certificate for that domain, with certificate count, first and last seen and a valid-certificate flag. #### Is the Subdomain Finder active scanning? By default no. With only the default `ct` source it reads public Certificate Transparency logs, so nothing is sent to the target domain. If you switch on `resolveIps`, `httpProbe` or `bruteForce`, it does send DNS queries and one HTTP request per host. Scan only domains you own or are authorized to assess. #### Why did the Subdomain Finder return 0 results? The domain may have no public certificates in Certificate Transparency logs, or a filter such as `onlyValidCerts`, `onlyResolving` or `onlyAlive` removed every hostname. The run still succeeds, says so in the status message and charges nothing. Try turning the filters off, or check that you entered the root domain. #### Why did my Subdomain Finder run fail? Either the input had no valid domain, or every source (crt.sh, Cert Spotter and the fallback sources) was unavailable for every domain you entered. The run then ends as failed with a clear message and is not charged. Run it again later, because crt.sh outages usually pass within minutes. #### Do I pay when crt.sh is down? No. When crt.sh returns 502 or times out, the actor retries, then asks Cert Spotter, then falls back to subdomain.center and RapidDNS. You pay only for the rows delivered, at the same $0.01 per subdomain. The `source` field shows which service answered. #### What do first seen and last seen mean in the Subdomain Finder? `firstSeen` is the earliest certificate start date and `lastSeen` the latest certificate start date found for that hostname in Certificate Transparency logs. They show when a hostname first got a public certificate and when it was last covered by one, which helps date new or abandoned hosts. #### What does the valid-cert flag mean in the Subdomain Finder? `hasValidCert` is `Yes` when at least one certificate covering the hostname expires in the future on the day of the run. It is `Unknown` when no Certificate Transparency source answered. It is a hint of use, not proof the host is live. #### Does a subdomain on a certificate mean the host is live? Not always. A certificate only proves a certificate was issued for that name, not that a server answers today. Turn on `resolveIps` for DNS and `httpProbe` for an HTTP status, then use `isAlive`, `dnsResolves` and `wildcardDnsMatch`. #### How many subdomains can one Subdomain Finder run return? Up to 1,000,000 rows per run on paid plans, set with `maxItems`. Free users get a 10-row preview. Set `maxItems` to the number of rows you want to pay for. A run also stops when no new row appears for 90 seconds. #### Does the Subdomain Finder need an API key? No. It reads crt.sh, the public Cert Spotter API and the other listed sources, which need no key, and it paces its requests. You only need an Apify account to run the actor, and free users get a 10-row preview. No crt.sh or Cert Spotter account is needed. #### Why is a Subdomain Finder run slow on large domains? crt.sh is a shared community service, and a large domain can take 25 seconds or more to answer, often with a 502 under load. The actor retries crt.sh inside a 75 second budget, then fails over to Cert Spotter, so very large domains may come back partial. #### Why do some Subdomain Finder rows say source certspotter? Those rows came from the fallback source. Cert Spotter lists only unexpired certificates, so you get current hostnames but not the full historical set that crt.sh holds. Counts are therefore lower and every hostname shows a valid certificate. The `source` field on each row tells you which service answered. #### How do I get only live hosts with IP addresses? Set `resolveIps` and `httpProbe` to true, then add `onlyResolving` to drop names with no DNS answer, `onlyAlive` to keep hosts that answer over HTTP, and `skipWildcardDnsMatches` to drop lookalikes of a catch-all DNS record. Each row then has `ipAddresses`, `httpStatus`, `httpTitle` and `behindCloudflare`, at no extra charge per row. ### ๐Ÿ”— Want related security and domain data? Other RecordsData actors - [Domain Intelligence Scraper](https://apify.com/RecordsData/domain-intelligence-scraper): WHOIS/RDAP, DNS and SSL data per domain - [CVE Vulnerabilities Scraper](https://apify.com/RecordsData/cve-vulnerabilities-scraper): NVD data with CISA KEV flags - [SEC EDGAR Filings Scraper](https://apify.com/RecordsData/sec-edgar-filings-scraper): breach disclosures in company filings ### ๐Ÿ†˜ Support Questions or bugs: use the Issues tab on the actor page or write to contact.punkrecordsdata@gmail.com. Independent tool, not affiliated with crt.sh or any certificate authority. Last updated: 2026-10-11 # Actor input Schema ## `domains` (type: `array`): Root domains to find subdomains for, for example apify.com or example.com (up to 2,000 per run). The actor scans each domain with the sources you pick below: Certificate Transparency logs (crt.sh, with automatic Cert Spotter fallback) by default. ## `maxItems` (type: `integer`): Maximum number of result rows to return (subdomains, summaries and certificate rows together). Free users: limited to 10 rows (preview). Paid users: up to 1,000,000. Also caps your spend. ## `sources` (type: `array`): Where host names come from. ct = Certificate Transparency logs (crt.sh, Cert Spotter fallback): the only source with certificate history, so it is the default. The others are free public lists that add hosts without certificates: hackertarget (free tier of about 50 searches per day per IP, skipped for the rest of the run once used up), rapiddns (its free page shows the first 100 hosts) and subdomaincenter. Hosts found by several sources are merged into one row and the sources column lists them all. If both Certificate Transparency services are down, subdomain.center and RapidDNS are used instead so the run still returns hosts (certificate columns stay empty and the source column says so); not with 'Only currently valid certificates'. ## `bruteForce` (type: `string`): Also try common host names (www, mail, api, dev, staging...) with a DNS lookup each and add the ones that exist. small = 59 names, medium = 311 names, a few seconds per domain. Names that only resolve because the domain has a wildcard DNS record are dropped. Skipped while 'Only currently valid certificates' is on. ## `onlyValidCerts` (type: `boolean`): Keep only subdomains that appear on at least one non-expired certificate. ## `includeWildcards` (type: `boolean`): Keep \*.domain.com style entries as their own rows. With DNS checks on, wildcard rows are listed after the real hosts (they have nothing to resolve). ## `onlyResolving` (type: `boolean`): Drop hosts without an A, AAAA or CNAME record that resolves, so expired and internal names disappear. Turns the DNS lookup on. ## `skipWildcardDnsMatches` (type: `boolean`): Many domains answer every name (random-label.example.com) with the same address. Hosts whose DNS answer is identical to that catch-all answer are dropped as likely noise. Turns the DNS lookup on. Without this filter such rows are kept and flagged in wildcardDnsMatch. ## `onlyAlive` (type: `boolean`): Keep only hosts that return an HTTP response on port 443 or 80. Turns the HTTP probe on. ## `resolveIps` (type: `boolean`): Look up A, AAAA and CNAME records for every host and add dnsResolves, ipAddresses, cname, behindCloudflare (address inside Cloudflare's published ranges) and wildcardDnsMatch. Included in the normal subdomain price. ## `httpProbe` (type: `boolean`): Send one GET request to every host that resolves (https first, then http; up to 3 same-host redirects) and add isAlive, httpStatus, httpTitle, httpServer, httpFinalUrl and httpResponseMs. Only public addresses are contacted. Turns the DNS lookup on. Included in the normal subdomain price. ## `probeTimeoutSecs` (type: `integer`): How long to wait for each HTTP attempt before the host counts as not answering. 1 to 10 seconds. ## `includeDomainSummary` (type: `boolean`): One row per domain scanned: total certificates, unique subdomains, top issuers. Billed as its own event. ## `includeCertificates` (type: `boolean`): One row per certificate (up to 200 newest per domain): issuer, common name, validity window and crt.sh id. Needs the ct source. Billed as its own event. ## Actor input object example ```json { "domains": [ "example.org" ], "maxItems": 10, "sources": [ "ct" ], "bruteForce": "none", "onlyValidCerts": false, "includeWildcards": true, "onlyResolving": false, "skipWildcardDnsMatches": false, "onlyAlive": false, "resolveIps": false, "httpProbe": false, "probeTimeoutSecs": 5, "includeDomainSummary": true, "includeCertificates": false } ``` # Actor output Schema ## `overview` (type: `string`): Every field of every row ## `fullData` (type: `string`): Complete dataset with all fields ## `subdomains` (type: `string`): Subdomain rows with DNS and HTTP data ## `summaries` (type: `string`): One summary row per domain scanned ## `certificates` (type: `string`): Certificate rows (when enabled) # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "example.org" ], "maxItems": 10 }; // Run the Actor and wait for it to finish const run = await client.actor("recordsdata/subdomain-finder-scraper").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`๐Ÿ’พ Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // ๐Ÿ“š Want to learn more ๐Ÿ“–? Go to โ†’ https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": ["example.org"], "maxItems": 10, } # Run the Actor and wait for it to finish run = client.actor("recordsdata/subdomain-finder-scraper").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"๐Ÿ’พ Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # ๐Ÿ“š Want to learn more ๐Ÿ“–? Go to โ†’ https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "example.org" ], "maxItems": 10 }' | apify call recordsdata/subdomain-finder-scraper --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,recordsdata/subdomain-finder-scraper" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/pp70ifxbYcupLbbTu/builds/SKdMNTpSnHbpOgysa/openapi.json