Subdomain Finder & Scanner – Find All Subdomains of a Domain
Pricing
from $0.50 / 1,000 subdomains
Subdomain Finder & Scanner – Find All Subdomains of a Domain
Find subdomains of any domain from certificate logs, passive DNS and the Internet Archive, merged into one list, with a live DNS check and IP addresses. Bulk domains. $0.50 per 1,000 subdomains, domains with none are free.
Pricing
from $0.50 / 1,000 subdomains
Rating
0.0
(0)
Developer
Rowfeed
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
a day ago
Last modified
Categories
Security
Limited permissionsShare
Find the subdomains of any domain, in bulk, as one clean list. The Actor asks four public sources at the same time and merges their answers, then checks which subdomains are live today.
Built for security reviews of your own domains, IT and SEO audits, competitor research and AI agents that need a domain's footprint.
Why four sources
Single sources go down often. In our tests crt.sh answered 502 or timed out on some calls and the Internet Archive answered 503 on others. This Actor uses:
- crt.sh and Cert Spotter: names on public TLS certificates
- HackerTarget: passive DNS records
- Internet Archive: host names of archived pages
If some sources are down, you still get what the others found, and the run's status message names the ones that missed. A later run may then find more. Every row says which sources saw that name.
Example output row
resolves is true when the name has an IPv4 or IPv6 address today, false when it has none (it may be gone, or used only for mail or similar), and null when the check could not tell. ips lists the addresses.
Input
| Field | What it does |
|---|---|
domains | Domains to look up, up to 500 per run. A full link also works. |
maxSubdomainsPerDomain | Caps very large domains. Default 1,000, maximum 20,000. |
checkDns | Checks each name and lists its IP addresses. On by default and included in the price. |
onlyLive | Delivers only names that resolve today. Old names are dropped and not charged. |
Pricing
Pay per event, no subscription:
- $0.50 per 1,000 subdomains ($0.0005 each).
- $0.001 per run start.
A domain with 50 subdomains costs about $0.03. A domain with no subdomains, or that could not be checked, costs nothing beyond the start. You can cap a run with the maximum charge setting and it stops cleanly there.
The pre-filled example runs live. If all sources are down at that moment, it answers from a saved real result instead (rows carry from_snapshot: true).
Good to know
- These are public, passive sources. The Actor does not scan or brute-force anything, and it never contacts the target's own servers. DNS checks go through Cloudflare's public resolver.
- The free sources limit how often they answer, so the number of subdomains can differ between runs. You only pay for what is delivered.
- No list like this is complete: a subdomain that never had a public certificate or an archived page will not show up.
- Certificates also list old names, so some subdomains no longer exist. Use
onlyLiveto keep the working ones. - Very large domains can stop at Cert Spotter's free page limit; the other sources still count.
- Use it on domains you own or may lawfully research.
More tools from Rowfeed
- WHOIS Lookup & DNS Checker – domain age, expiry, DNS, SSL and an SPF/DMARC grade.
- Website Technology Checker – CMS, analytics and hosting of any website.
- Website Email Extractor & Contact Finder – company emails and phones from websites.
