Subdomain Finder (Passive, Certificate Transparency Logs) avatar

Subdomain Finder (Passive, Certificate Transparency Logs)

Pricing

$0.50 / 1,000 subdomains

Go to Apify Store
Subdomain Finder (Passive, Certificate Transparency Logs)

Subdomain Finder (Passive, Certificate Transparency Logs)

Discover subdomains passively from public Certificate Transparency logs (crt.sh with CertSpotter fallback): unique hostnames, certificate count, first/last certificate date, issuers. No scanning or traffic to the target.

Pricing

$0.50 / 1,000 subdomains

Rating

0.0

(0)

Developer

CarrierDaily

CarrierDaily

Maintained by Community

Actor stats

0

Bookmarked

2

Total users

1

Monthly active users

2 days ago

Last modified

Categories

Share

Discover subdomains passively from public Certificate Transparency logs (crt.sh with CertSpotter fallback): unique hostnames, certificate count, first/last certificate date, issuers. No scanning or traffic to the target.

Why this actor

  • Passive-only (legal/low-risk), automatic fallback when crt.sh is down, deduped with dates.
  • Pay only for results: $0.50 per 1,000 subdomains, no start fee, failed lookups are free.
  • Robust: automatic retries with exponential backoff, respects Retry-After, per-item error rows instead of crashed runs.
  • Clean, flat JSON/CSV/Excel output ready for Google Sheets, Make, Zapier, n8n, Clay, or the Apify API.

Use cases

  • Attack-surface inventory of your own org
  • Vendor security reviews
  • Find SaaS/tool usage of prospects (e.g. status., help.)
  • Bug bounty recon (in-scope)

Input

FieldTypeDescription
domainsarrayRoot domains. Passive discovery from public Certificate Transparency logs — no scanning of the target.
excludeExpiredbooleanOnly subdomains with currently valid certificates.
maxItemsinteger0 = no limit. Caps cost.

Example input:

{
"domains": [
"apify.com"
]
}

Output

Each dataset item looks like this (real sample from a test run, long fields trimmed):

{
"domain": "apify.com",
"subdomain": "affiliate.apify.com",
"level": 1,
"certificates": 16,
"firstCertAt": "2025-06-03",
"lastCertAt": "2026-08-09",
"issuers": [
"Let's Encrypt"
],
"source": "crt.sh",
"scrapedAt": "2026-10-14T16:24:29+00:00"
}

Rows that could not be processed contain an error field and are not charged.

Pricing

Pay-per-event: $0.0005 per subdomain (= $0.50 / 1,000). Use Max results to cap spend. Apify's free plan credit covers thousands of results per month.

Integrations & API

Run on a schedule in Apify Console, call via the Apify API / Python & JS clients, or connect to Make, Zapier, n8n, Google Sheets, Slack and webhooks. Works as a tool for AI agents via Apify MCP.

FAQ

Is this an official tool? No. It is an independent actor and is not affiliated with, sponsored or endorsed by the data source or any trademark owner named here.

Is it legal? The actor only reads publicly available data from public endpoints, without logins, and does not bypass paywalls or access controls. You are responsible for using the data in line with applicable laws (e.g. GDPR) and the source sites' terms.

Something broke? Open an issue in the Issues tab; we typically respond within 24 hours and ship fixes fast.