🔍 Subdomain Finder

Discover subdomains for any domain using Certificate Transparency logs (crt.sh). Essential for security audits, penetration testing, asset inventory.

Store Quickstart

Start with the Quickstart template (single domain). For large asset inventories, use Enterprise Audit with up to 50 domains.

Key Features

• 🔍 Certificate Transparency logs — Uses crt.sh — the authoritative CT log database
• 📊 Full subdomain history — Active AND expired certificates both discoverable
• 🏷️ Issuer tracking — See which CA issued each certificate
• 📅 Validity dates — validFrom / validTo per certificate
• 🎯 Deduplication — Unique subdomains only, no duplicates
• 🔑 No API key needed — Free public CT log database

Use Cases

Who	Why
Penetration testers	Discover forgotten subdomains as attack surface
Asset inventory teams	Full catalog of company-wide subdomains
Bug bounty hunters	Find in-scope targets via CT logs
M&A due diligence	Audit acquired company's public infrastructure
DNS auditors	Cross-reference CT logs with DNS records to find orphaned subdomains

Input

Field	Type	Default	Description
domains	string[]	(required)	Domains to scan (max 50)
includeExpired	boolean	false	Include expired certificates
dedup	boolean	true	Deduplicate subdomain names

Input Example

{
  "domains": ["example.com", "target.org"],
  "includeExpired": false,
  "dedup": true
}

Output Example

{
  "domain": "example.com",
  "subdomains": [
    {"name": "api.example.com", "issuer": "Let's Encrypt", "validFrom": "2026-01-01", "validTo": "2026-04-01"},
    {"name": "mail.example.com", "issuer": "DigiCert", "validFrom": "2025-06-01", "validTo": "2026-06-01"}
  ],
  "totalFound": 42
}

FAQ

Will I find ALL subdomains?

Only those with valid HTTPS certificates. HTTP-only subdomains and those using wildcard certs are missed.

What about wildcard certificates?

Wildcard certs (*.example.com) appear as a single entry. Individual subdomains under them may not be listed.

Is crt.sh reliable?

Yes — it aggregates all public CT logs required by browser vendors. Very comprehensive.

Can I scan a competitor's domain?

Publicly — yes, CT logs are public by design. Always comply with your jurisdiction's laws.

Related Actors

DevOps & Tech Intel cluster — explore related Apify tools:

• 🌐 DNS Propagation Checker — Check DNS propagation across 8 global resolvers (Google, Cloudflare, Quad9, OpenDNS).
• 🧹 CSV Data Cleaner — Clean CSV data: trim whitespace, remove empty rows, deduplicate by columns, sort.
• 📦 NPM Package Analyzer — Analyze npm packages: download stats, dependencies, licenses, deprecation status.
• 📊 SEC EDGAR Monitor — Monitor SEC EDGAR filings for US public companies by ticker or CIK.

Cost

Pay Per Event:

• actor-start: $0.01 (flat fee per run)
• dataset-item: $0.003 per output item

Example: 1,000 items = $0.01 + (1,000 × $0.003) = $3.01

No subscription required — you only pay for what you use.