Subdomain Finder (Certificate Transparency)

What is Subdomain Finder?

Subdomain Finder is an Apify Actor that enumerates every subdomain of a domain from the public Certificate Transparency (CT) logs and tells you which ones are still alive. Give it apify.com and you get back docs.apify.com, console.apify.com, staging.apify.com, forgotten dev- and test- hosts — one clean row per subdomain, with the certificate history and a fresh DNS lookup attached.

It reads two free aggregators of the CT logs: crt.sh first (the richest index) and Cert Spotter as an automatic fallback when crt.sh is down. No proxies, no API key, no browser.

What data does Subdomain Finder extract?

Subdomain Finder extracts one row per hostname that has ever appeared in a publicly logged TLS certificate for your domain, plus live DNS state:

Field	Type	Description
subdomain	string?	Hostname found, e.g. docs.apify.com. null if the domain had no certificates
domain	string?	The root domain from your input, or null if input validation failed
firstSeen	string?	Earliest certificate notBefore date (ISO 8601 UTC), or null if no certs
lastSeen	string?	Latest certificate notAfter date, or null if no certs
certificateCount	integer?	Distinct certificates covering this hostname, or null if no certs
issuers	array?	Certificate authorities, e.g. ["Let's Encrypt", "DigiCert Inc"], or null
isWildcard	boolean?	True for names like *.apify.com, or null if no data
resolves	boolean?	True when the host returns an A record. null if DNS was off or failed
ipv4	array?	Current A records, or null if DNS was off or failed
cname	string?	First CNAME target — the classic subdomain-takeover signal, or null
source	string?	crt.sh or certspotter, or null on error
error	string?	Why a domain returned nothing, e.g. No certificates found. null on success
scrapedAt	string	Run timestamp (ISO 8601 UTC) — always present

How to use Subdomain Finder

1. Paste your root domains into Domains. Bare domains and full URLs both work — https://www.apify.com/pricing is reduced to apify.com.
2. Leave Resolve DNS on to separate live hosts from dead certificate records; turn it off for a pure certificate inventory.
3. Set Max subdomains per domain (default 500). When the cap is hit, the hostnames with the most recently issued certificates are kept.
4. Turn on Include wildcard names if you want *.example.com rows too, then click Start and export as JSON, CSV, Excel or HTML.

Example input

{
    "domains": ["apify.com", "github.com"],
    "resolveDns": true,
    "includeWildcards": false,
    "maxSubdomainsPerDomain": 500,
    "maxConcurrency": 5
}

Example output

{
    "subdomain": "api.mcp.github.com",
    "domain": "github.com",
    "firstSeen": "2025-08-22T00:00:00.000Z",
    "lastSeen": "2026-10-22T19:38:13.000Z",
    "certificateCount": 3,
    "issuers": ["DigiCert Inc", "Let's Encrypt"],
    "isWildcard": false,
    "resolves": true,
    "ipv4": ["140.82.113.22"],
    "cname": "glb-db52c2cf8be544.github.com",
    "source": "crt.sh",
    "error": null,
    "scrapedAt": "2026-09-12T15:48:11.438Z"
}

Input parameters

Parameter	Type	Default	Description
domains	array	["apify.com"]	Root domains to enumerate
resolveDns	boolean	true	A-record lookup per subdomain, fills resolves, ipv4, cname
includeWildcards	boolean	false	Also return *.example.com names
maxSubdomainsPerDomain	integer	500	Cap per domain (1–10,000), freshest certificates kept
maxConcurrency	integer	5	Domains queried in parallel (1–20)

Pricing

Subdomain Finder uses pay-per-event pricing: $0.0005 per subdomain row — $0.50 per 1,000 subdomains — plus a negligible $0.00005 Actor-start fee, platform usage included. A typical mid-size company returns 30–120 rows, so a 100-domain portfolio audit costs roughly $2–6. Set Maximum cost per run to cap spend: the Actor trims its output to whatever your limit can pay for and never pushes an uncharged row.

Subdomain Finder vs. Amass and Subfinder

Amass and Subfinder are excellent CLIs, but they need a machine, a Go toolchain, config files and API keys for every data source before they return a single name. Subdomain Finder needs a domain in a text box. It runs on a schedule, stores every run as a queryable dataset that diffs cleanly against the previous one, and returns JSON over the API. For deep brute-force enumeration with dozens of paid sources, keep Amass; for fast, repeatable CT-log inventory across many domains, use this.

Using Subdomain Finder with AI agents and MCP

Subdomain Finder runs on pay-per-event pricing with limited permissions — the two requirements for an Actor to be callable through the Apify MCP server at mcp.apify.com. An agent passes domains and gets back a flat list of hostnames with live/dead status, which is exactly the shape a recon or asset-inventory agent needs. It also connects to n8n, Make, Zapier and LangChain through Apify's integrations.

FAQ

Does this find every subdomain? No, and no CT-based tool can. Certificate Transparency only shows hostnames that at some point received a publicly logged TLS certificate. Internal hosts on private CAs, plain-HTTP hosts, and names hidden behind a wildcard certificate never appear. Treat the output as a high-confidence floor, not a complete map.

Why are some rows resolves: false? The certificate exists in the logs but the DNS record is gone — a decommissioned staging host. Those rows are the interesting ones for attack-surface cleanup, and a dangling cname on a live record is the classic subdomain-takeover signal.

Why does source say certspotter? crt.sh returns HTTP 502 fairly often, especially for very large domains. The Actor retries it three times with backoff and then falls back to Cert Spotter automatically, so a run still returns data. Cert Spotter is rate-limited for anonymous use and returns a shallower history, so row counts can be lower.

Is this legal to run? Yes. Certificate Transparency logs are public, append-only and designed to be read; DNS lookups use Google's public resolver, and no personal data is collected.

Can I export as CSV or Excel? Yes, from the Output tab and the API.

Related Actors

Part of the webdatatools web-intelligence suite — every Actor is pay-per-event, runs without proxies or a headless browser, and returns one clean row per entity:

Website & domain intelligence

• Website Contact & Social Extractor — e-mails, phones and social profiles per domain
• Website Tech Stack Detector — CMS, e-commerce, analytics, pixels and payments per domain
• Domain DNS & Email Security Checker — SPF, DKIM, DMARC, MX provider, registrar and domain age
• Domain Security Audit — TLS expiry, security headers, redirect chain, robots and llms.txt
• Bulk Core Web Vitals & PageSpeed Audit — Lighthouse scores, LCP, CLS, INP and top fixes per URL
• On-Page SEO Audit — title, meta, headings, links, images and schema issues per page
• Sitemap URL Extractor & Change Monitor — every sitemap URL, or new and removed pages between runs
• Wayback Machine Snapshot & Page Change Tracker — how a page changed over time, or every archived snapshot

Content for AI, LLMs and RAG

• AI Web Search & Read — a query turned into clean Markdown from the top search results
• Website to Markdown Crawler for LLM & RAG — any site as clean Markdown per page, no browser
• Article & News Extractor — clean article text, author, date and Markdown per URL
• Structured Data & JSON-LD Extractor — Schema.org and Open Graph data from any page
• Google News Scraper — news results by keyword, topic or site
• Press Release Monitor — PR Newswire, Business Wire and GlobeNewswire releases

Search, video and social

• Google Search Results Scraper — organic SERP results per keyword and country
• YouTube Comments Scraper — comments and replies with likes, no API key
• YouTube Channel Latest Videos — the latest 15 videos of any channel from RSS
• YouTube Channel Videos Scraper — a channel's full video, shorts and stream list
• YouTube Search Results Scraper — videos, channels and playlists per query
• YouTube Video Details Scraper — views, likes, description, tags and chapters per video
• Apple Podcasts Lookup & Episodes Scraper — podcast metadata and episodes from iTunes and RSS
• Bluesky Scraper — posts, profiles, followers and threads from the AT Protocol API

Leads, jobs and company data

• Company 360 — one row per domain: contacts, tech, security, hiring and company facts
• Hiring Signals Scraper — open jobs and hiring velocity from 10 public ATS boards
• Y Combinator Companies & Founders Scraper — YC startups by batch, industry and hiring status
• Wikidata Entity & Company Enrichment — HQ, founders, employees, revenue and social IDs per company
• Bulk Email Validator — syntax, MX, disposable, role and free-provider checks
• OpenStreetMap POI Extractor — shops and amenities by radius, bbox or area

Developer, app and research data

• npm, PyPI & Crates.io Package Health Checker — releases, downloads, deprecation and a health score
• GitHub Repository Health & Activity Report — stars, commits, contributors and risk flags per repo
• VS Code Marketplace Extension Scraper — installs, ratings and versions per extension
• Chrome Web Store Extension Scraper — users, rating, version and developer per extension
• Google Play Store Scraper — apps, ratings, installs, developer contact and reviews
• App Store (iOS) App Metadata & Top Charts — ratings, price, version and charts per app
• CrossRef DOI & Citation Metadata Lookup — papers, authors, journals and citation counts
• FDA Recalls & Adverse Events Monitor — food, drug and device recalls from openFDA
• iCal / ICS Calendar Feed to Events Extractor — any public calendar feed as event rows
• Shopify Store Products Scraper — catalog, prices, variants and stock per store

Support and feedback

Missing a subdomain you know exists, or want another CT source added? Open an issue on the Issues tab.