Subdomain Finder (Passive, Certificate Transparency Logs)
Pricing
$0.50 / 1,000 subdomains
Subdomain Finder (Passive, Certificate Transparency Logs)
Discover subdomains passively from public Certificate Transparency logs (crt.sh with CertSpotter fallback): unique hostnames, certificate count, first/last certificate date, issuers. No scanning or traffic to the target.
Pricing
$0.50 / 1,000 subdomains
Rating
0.0
(0)
Developer
CarrierDaily
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
2 days ago
Last modified
Categories
Share
Discover subdomains passively from public Certificate Transparency logs (crt.sh with CertSpotter fallback): unique hostnames, certificate count, first/last certificate date, issuers. No scanning or traffic to the target.
Why this actor
- Passive-only (legal/low-risk), automatic fallback when crt.sh is down, deduped with dates.
- Pay only for results: $0.50 per 1,000 subdomains, no start fee, failed lookups are free.
- Robust: automatic retries with exponential backoff, respects
Retry-After, per-item error rows instead of crashed runs. - Clean, flat JSON/CSV/Excel output ready for Google Sheets, Make, Zapier, n8n, Clay, or the Apify API.
Use cases
- Attack-surface inventory of your own org
- Vendor security reviews
- Find SaaS/tool usage of prospects (e.g. status., help.)
- Bug bounty recon (in-scope)
Input
| Field | Type | Description |
|---|---|---|
domains | array | Root domains. Passive discovery from public Certificate Transparency logs — no scanning of the target. |
excludeExpired | boolean | Only subdomains with currently valid certificates. |
maxItems | integer | 0 = no limit. Caps cost. |
Example input:
{"domains": ["apify.com"]}
Output
Each dataset item looks like this (real sample from a test run, long fields trimmed):
{"domain": "apify.com","subdomain": "affiliate.apify.com","level": 1,"certificates": 16,"firstCertAt": "2025-06-03","lastCertAt": "2026-08-09","issuers": ["Let's Encrypt"],"source": "crt.sh","scrapedAt": "2026-10-14T16:24:29+00:00"}
Rows that could not be processed contain an error field and are not charged.
Pricing
Pay-per-event: $0.0005 per subdomain (= $0.50 / 1,000). Use Max results to cap spend. Apify's free plan credit covers thousands of results per month.
Integrations & API
Run on a schedule in Apify Console, call via the Apify API / Python & JS clients, or connect to Make, Zapier, n8n, Google Sheets, Slack and webhooks. Works as a tool for AI agents via Apify MCP.
FAQ
Is this an official tool? No. It is an independent actor and is not affiliated with, sponsored or endorsed by the data source or any trademark owner named here.
Is it legal? The actor only reads publicly available data from public endpoints, without logins, and does not bypass paywalls or access controls. You are responsible for using the data in line with applicable laws (e.g. GDPR) and the source sites' terms.
Something broke? Open an issue in the Issues tab; we typically respond within 24 hours and ship fixes fast.