Subdomain Finder

Find every subdomain of any domain. The actor merges four independent discovery sources, deduplicates the results, and verifies each candidate with DNS resolution and a live HTTP/HTTPS probe. Each result tells you which sources found it, whether it resolves, what IPs it points to, and the HTTP status + page title behind it.

What you can do with it

• Attack-surface monitoring for your own apex domains.
• Pre-engagement recon for security audits and bug bounty work.
• Competitive intelligence — see which services and vendors a domain exposes.
• Asset inventory automation across acquired or merged companies.

How discovery works

Four sources run in parallel; one failing (quota, transient HTTP error) does not kill the run:

1. Certificate transparency logs — the gold standard; catches anything that has ever been issued a TLS cert.
2. Public hostsearch API — passive DNS data, free tier.
3. Passive DNS aggregator — long-tail historical resolutions.
4. DNS bruteforcing — built-in wordlists (small ~100 names, medium ~1000) tried against the apex domain. Catches infrastructure subdomains (k8s, vault, gitlab, metrics, etc.) that never appear in passive sources.

Each result lists exactly which sources saw it, so you can confidence-grade discoveries and spot source drift over time.

Input

{
  "domains": ["thirdwatch.dev"],
  "sources": ["crtsh", "hackertarget", "rapiddns", "dnsbruteforce"],
  "bruteforceWordlist": "small",
  "verifyAlive": true,
  "httpProbe": true,
  "timeoutMinutes": 5
}

Field	Type	Default	Description
domains	string[]	—	Apex domains, no scheme/subdomain.
sources	string[]	all 4	Subset of crtsh, hackertarget, rapiddns, dnsbruteforce.
bruteforceWordlist	enum	small	none, small (~100), medium (~1000).
verifyAlive	boolean	true	DNS-resolve every candidate.
httpProbe	boolean	true	HTTP+HTTPS GET to capture status + title.
timeoutMinutes	integer	5	Per-domain budget.
proxyConfiguration	object	none	Optional Apify proxy.

Output (one item per subdomain)

{
  "apex_domain": "thirdwatch.dev",
  "subdomain": "mcp.thirdwatch.dev",
  "dns_resolves": true,
  "ip_addresses": ["104.21.10.5"],
  "sources": ["crtsh", "hackertarget"],
  "http_status": 301,
  "https_status": 200,
  "http_title": null,
  "https_title": "Thirdwatch MCP",
  "is_alive": true,
  "discovered_at": "2026-05-04T10:00:00+00:00"
}

Please only enumerate domains you own or have authorization to test.

Limitations

• Coverage depends on what each source has indexed; freshly-issued subdomains may not appear in certificate transparency logs for hours.
• The HackerTarget source has a free quota (~50 queries/day per IP); when exhausted, that source returns nothing for that day and the run continues with the others.
• DNS bruteforcing uses our built-in wordlists. Highly custom internal naming (e.g. project codenames) won't be found by brute alone — it will surface only through certificate transparency or passive DNS.
• The HTTP probe times out after 5 seconds per host; very slow hosts may show as null status even when alive.

Last verified

2026-05