Subdomain Inventory & Website Technology Checks

Check the publicly disclosed PHP, web-server and CMS versions of websites you are authorized to assess. Ask a technology question, review the supporting headers or generator metadata, and export matches alongside explicit unknowns. You can also discover and monitor subdomains using public certificate tables and native DNS.

Check a website list

In Apify Console, enter your authorized root domains, add Specific websites to check, and enter a Technology question. Start with one or two websites and a small result and spending limit.

{
  "authorizedUseOnly": true,
  "domains": ["example.co.nz"],
  "websiteUrls": ["https://example.co.nz/", "https://www.example.co.nz/"],
  "technologyQuery": "PHP below 8.0 on .co.nz",
  "limits": {"maxResultsPerDomain": 5, "maxTotalResults": 10}
}

Replace the example with your authorized websites. Each URL is reduced to its hostname and only its homepage is profiled; paths and query strings are ignored. The website-list workflow uses profile-only mode, with DNS wordlists and wildcard discovery off by default. Hosts must fall within the supplied root domains. A suffix such as co.nz alone is not a root domain.

Bring an existing website list, including a list collected by a separate search workflow. This Actor does not discover every website in a country or execute a search-engine query. A suffix narrows matching; other supplied hosts can still be profiled. Supply only your intended targets to bound requests.

Questions you can ask

Question	Result
PHP below 8.0 on .co.nz	Compare disclosed PHP versions within the suffix
Find .co.nz sites running PHP 7.4	Match the PHP 7.4 version family
Which version of WordPress do these sites expose?	Report explicit WordPress generator versions
nginx >=1.24	Compare disclosed server versions numerically
Find sites with Laravel	Match visible framework indicators
Show Apache websites	Match Apache HTTP Server indicators

One supported technology, one optional version comparison and one optional suffix are supported per run. Unsupported wording, compound conditions and negation produce an input error. Set counts with limits, rather than placing a number of websites in the question. For structured API input, use technologyFilter instead of technologyQuery:

{"technologyFilter": {"technology": "PHP", "version": "<8.0", "domainSuffix": "co.nz"}}

Bare 7.4 or 7.4.x means the version family. Comparisons support <, <=, >, >=, = and !=; omitted comparison-bound components mean zero. Partial observations retain uncertainty: 8.2 cannot establish patch 8.2.17. Ordering of prerelease or vendor version suffixes is not guessed.

PHP, nginx, Apache, WordPress, Drupal, Joomla, ASP.NET, Express and Laravel are supported, alongside the existing CDN, frontend and analytics catalog. A supported name does not guarantee a visible version. Website-list checks and technology questions enable version hints; legacy discovery keeps its existing version-hint default.

Read and export the results

Open Technology query matches or Technology query unknowns in the dataset views. Download the full inventory as JSON, CSV or Excel. All inventory rows are retained, including unknown and non-matching rows, and retain existing result pricing. OUTPUT.technologyQuery reports the interpreted query and counts only confirmed delivered rows, including partial runs stopped by a spending cap.

Field	Meaning
fqdn, rootDomain	Website hostname and its declared root scope
phpVersion	One unambiguous disclosed PHP version; blank means unknown
phpDetectionStatus	Disclosed, version unknown, conflicting, not observed, not checked, or external redirect
technologyVersions	Explicitly disclosed technology/version pairs within the target root
technologyMatchStatus	match, no_match or unknown for the question
technologyQueryResult	Reason, version, response URL, confidence and evidence
lastCheckedAt	Observation timestamp

Selected fields from an illustrative result:

{
  "fqdn": "www.example.co.nz",
  "phpVersion": "7.4.33",
  "phpDetectionStatus": "version_disclosed",
  "technologyVersions": ["PHP 7.4.33"],
  "technologyMatchStatus": "match"
}

PHP presence can be indicated by a cookie name without revealing a version. Versions are never inferred from WordPress or a .php URL. Missing or conflicting disclosures remain unknown. Header disclosures from HEAD and GET are retained for the same final URL, including a usable HEAD response when the homepage body cannot be downloaded. A redirect to another root domain does not establish the original site's version.

Public headers and generator metadata are disclosures, not independent proof of the runtime. Absence of a signal does not prove technology absence. A version match does not establish a vulnerability or complete country-wide coverage.

Discover subdomains and monitor a watchlist

For ordinary inventory, omit websiteUrls and the technology question:

{"authorizedUseOnly": true, "domains": ["example.com"], "searchLevel": "quick"}

Start with quick; deep and extraDeep expand configured DNS candidate work and can increase time and cost. Certificate names are historical evidence, not proof that a host is live or still owned by the same organization. Public crt.sh HTML, native DNS and configured wordlists remain available. Third-party API adapters remain accepted for compatibility but report SOURCE_API_DISABLED. No child Actors run and no webhook is sent.

Output includes available DNS, HTTP, TLS, provider and technology observations, source statistics, errors, reports, graphs and optional screenshots. Review source errors and incomplete coverage alongside the dataset.

For repeat-run monitoring, supply monitoringOptions with monitoringMode set to updateBaseline and a unique baselineStoreName. Reuse that name and comparable settings, with one active run per watchlist. compareWithPrevious reads without updating. The first definitive observation establishes history; updates happen after confirmed delivery. Missing or failed observations never prove removal. History retains up to 10,000 records for 90 days and is pruned during later runs. Unchanged delivered inventory rows can still incur result events.

Run with Python

import os
from apify_client import ApifyClient

client = ApifyClient(os.environ["APIFY_TOKEN"])
run = client.actor("thescrapelab/subdomain-intelligence-osint").call(run_input={
    "authorizedUseOnly": True,
    "domains": ["example.co.nz"],
    "websiteUrls": ["https://example.co.nz/"],
    "technologyQuery": "PHP below 8.0 on .co.nz",
    "limits": {"maxResultsPerDomain": 5, "maxTotalResults": 10},
})
if run is None:
    raise RuntimeError("No run metadata returned")
for row in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(row["fqdn"], row.get("phpVersion", "unknown"),
          row.get("technologyMatchStatus"))

Pricing, limits and support

The listed inventory result fee is $0.00049 per row, plus $0.00005 startup per allocated GB with a minimum of one startup unit. Check the Console preview for your active tier and any platform-usage charges. Set a maximum run charge before scaling. Queries create no new premium events; unknown and non-matching inventory rows can still incur the existing result fee.

Use this Actor only for authorized inventory and non-invasive public metadata checks. It does not exploit services, bypass authentication, attempt login, fuzz paths, run broad port scans or claim resources. Priority and possible-takeover labels are informational. It creates no schedules or recurring tests.

For support, use the Actor's Issues tab with the run ID, affected authorized domain and error code. Keep credentials and private data out of support messages. This independent tool is not affiliated with crt.sh or the detected technologies.