# Subdomain Finder - Discover Every Subdomain Of A Domain (`thirdwatch/subdomain-finder`) Actor Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe. - **URL**: https://apify.com/thirdwatch/subdomain-finder.md - **Developed by:** [Thirdwatch](https://apify.com/thirdwatch) (community) - **Categories:** Developer tools, SEO tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing from $0.70 / 1,000 results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Subdomain Finder Find every subdomain of any domain. The actor merges four independent discovery sources, deduplicates the results, and verifies each candidate with DNS resolution and a live HTTP/HTTPS probe. Each result tells you which sources found it, whether it resolves, what IPs it points to, and the HTTP status + page title behind it. ### What you can do with it - Attack-surface monitoring for your own apex domains. - Pre-engagement recon for security audits and bug bounty work. - Competitive intelligence — see which services and vendors a domain exposes. - Asset inventory automation across acquired or merged companies. ### How discovery works Four sources run in parallel; one failing (quota, transient HTTP error) does not kill the run: 1. **Certificate transparency logs** — the gold standard; catches anything that has ever been issued a TLS cert. 2. **Public hostsearch API** — passive DNS data, free tier. 3. **Passive DNS aggregator** — long-tail historical resolutions. 4. **DNS bruteforcing** — built-in wordlists (`small` ~100 names, `medium` ~1000) tried against the apex domain. Catches infrastructure subdomains (`k8s`, `vault`, `gitlab`, `metrics`, etc.) that never appear in passive sources. Each result lists exactly which sources saw it, so you can confidence-grade discoveries and spot source drift over time. ### Input ```json { "domains": ["thirdwatch.dev"], "sources": ["crtsh", "hackertarget", "rapiddns", "dnsbruteforce"], "bruteforceWordlist": "small", "verifyAlive": true, "httpProbe": true, "timeoutMinutes": 5 } ```` | Field | Type | Default | Description | |------|------|---------|-------------| | `domains` | string\[] | — | Apex domains, no scheme/subdomain. | | `sources` | string\[] | all 4 | Subset of `crtsh`, `hackertarget`, `rapiddns`, `dnsbruteforce`. | | `bruteforceWordlist` | enum | `small` | `none`, `small` (~100), `medium` (~1000). | | `verifyAlive` | boolean | `true` | DNS-resolve every candidate. | | `httpProbe` | boolean | `true` | HTTP+HTTPS GET to capture status + title. | | `timeoutMinutes` | integer | `5` | Per-domain budget. | | `proxyConfiguration` | object | none | Optional Apify proxy. | ### Output (one item per subdomain) ```json { "apex_domain": "thirdwatch.dev", "subdomain": "mcp.thirdwatch.dev", "dns_resolves": true, "ip_addresses": ["104.21.10.5"], "sources": ["crtsh", "hackertarget"], "http_status": 301, "https_status": 200, "http_title": null, "https_title": "Thirdwatch MCP", "is_alive": true, "discovered_at": "2026-05-04T10:00:00+00:00" } ``` Please only enumerate domains you own or have authorization to test. ### Limitations - Coverage depends on what each source has indexed; freshly-issued subdomains may not appear in certificate transparency logs for hours. - The HackerTarget source has a free quota (~50 queries/day per IP); when exhausted, that source returns nothing for that day and the run continues with the others. - DNS bruteforcing uses our built-in wordlists. Highly custom internal naming (e.g. project codenames) won't be found by brute alone — it will surface only through certificate transparency or passive DNS. - The HTTP probe times out after 5 seconds per host; very slow hosts may show as `null` status even when alive. ### Last verified 2026-05 # Actor input Schema ## `domains` (type: `array`): Apex domains to enumerate subdomains for. No scheme, no subdomain (e.g. 'example.com', not 'https://www.example.com'). ## `sources` (type: `array`): Passive sources to merge. crtsh = certificate transparency, hackertarget = HackerTarget API, rapiddns = RapidDNS HTML scraping, dnsbruteforce = DNS-resolve common subdomain names from a built-in wordlist. ## `bruteforceWordlist` (type: `string`): Built-in wordlist size for DNS bruteforcing. 'none' = skip bruteforce. 'small' = ~100 most common subdomains. 'medium' = ~1000 names. ## `verifyAlive` (type: `boolean`): DNS-resolve each candidate subdomain. Subdomains that don't resolve are flagged with dns\_resolves=false but still returned. ## `httpProbe` (type: `boolean`): Send HTTP and HTTPS GET requests to each subdomain to detect live web servers. Captures status code + page title. ## `timeoutMinutes` (type: `integer`): Maximum time to spend on a single apex domain before moving on. ## `proxyConfiguration` (type: `object`): Optional Apify proxy. Most public sources work without proxy. ## Actor input object example ```json { "domains": [ "onescales.com" ], "sources": [ "crtsh", "hackertarget", "rapiddns", "dnsbruteforce" ], "bruteforceWordlist": "small", "verifyAlive": true, "httpProbe": true, "timeoutMinutes": 5, "proxyConfiguration": { "useApifyProxy": false } } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "onescales.com" ], "sources": [ "crtsh", "hackertarget", "rapiddns", "dnsbruteforce" ] }; // Run the Actor and wait for it to finish const run = await client.actor("thirdwatch/subdomain-finder").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": ["onescales.com"], "sources": [ "crtsh", "hackertarget", "rapiddns", "dnsbruteforce", ], } # Run the Actor and wait for it to finish run = client.actor("thirdwatch/subdomain-finder").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "onescales.com" ], "sources": [ "crtsh", "hackertarget", "rapiddns", "dnsbruteforce" ] }' | apify call thirdwatch/subdomain-finder --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=thirdwatch/subdomain-finder", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Subdomain Finder - Discover Every Subdomain Of A Domain", "description": "Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.", "version": "1.0", "x-build-id": "doaPJBHY7H9P3RCyB" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/thirdwatch~subdomain-finder/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-thirdwatch-subdomain-finder", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/thirdwatch~subdomain-finder/runs": { "post": { "operationId": "runs-sync-thirdwatch-subdomain-finder", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/thirdwatch~subdomain-finder/run-sync": { "post": { "operationId": "run-sync-thirdwatch-subdomain-finder", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "domains" ], "properties": { "domains": { "title": "Apex Domains", "type": "array", "description": "Apex domains to enumerate subdomains for. No scheme, no subdomain (e.g. 'example.com', not 'https://www.example.com').", "default": [ "onescales.com" ], "items": { "type": "string" } }, "sources": { "title": "Discovery Sources", "type": "array", "description": "Passive sources to merge. crtsh = certificate transparency, hackertarget = HackerTarget API, rapiddns = RapidDNS HTML scraping, dnsbruteforce = DNS-resolve common subdomain names from a built-in wordlist.", "default": [ "crtsh", "hackertarget", "rapiddns", "dnsbruteforce" ], "items": { "type": "string" } }, "bruteforceWordlist": { "title": "Bruteforce Wordlist Size", "enum": [ "none", "small", "medium" ], "type": "string", "description": "Built-in wordlist size for DNS bruteforcing. 'none' = skip bruteforce. 'small' = ~100 most common subdomains. 'medium' = ~1000 names.", "default": "small" }, "verifyAlive": { "title": "Verify Alive (DNS)", "type": "boolean", "description": "DNS-resolve each candidate subdomain. Subdomains that don't resolve are flagged with dns_resolves=false but still returned.", "default": true }, "httpProbe": { "title": "HTTP Probe", "type": "boolean", "description": "Send HTTP and HTTPS GET requests to each subdomain to detect live web servers. Captures status code + page title.", "default": true }, "timeoutMinutes": { "title": "Timeout per Domain (minutes)", "minimum": 1, "maximum": 60, "type": "integer", "description": "Maximum time to spend on a single apex domain before moving on.", "default": 5 }, "proxyConfiguration": { "title": "Proxy Configuration", "type": "object", "description": "Optional Apify proxy. Most public sources work without proxy.", "default": { "useApifyProxy": false } } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```