Subdomain Finder (Certificate Transparency) avatar

Subdomain Finder (Certificate Transparency)

Pricing

from $0.30 / 1,000 results

Try for free
Go to Apify Store
Subdomain Finder (Certificate Transparency)

Subdomain Finder (Certificate Transparency)

Try for free

Subdomain Finder enumerates every subdomain of a domain from Certificate Transparency logs (crt.sh, Cert Spotter) and resolves each one — one row per subdomain, no proxies needed.

Pricing

from $0.30 / 1,000 results

Rating

0.0

(0)

Developer

Murat Uzun

Murat Uzun

Maintained by Community

Actor stats

0

Bookmarked

2

Total users

1

Monthly active users

2 days ago

Last modified

Categories

Developer tools

SEO tools

Automation

Share

What is Subdomain Finder?

Subdomain Finder is an Apify Actor that enumerates every subdomain of a domain from the public Certificate Transparency (CT) logs and tells you which ones are still alive. Give it apify.com and you get back docs.apify.com, console.apify.com, staging.apify.com, forgotten dev- and test- hosts — one clean row per subdomain, with the certificate history and a fresh DNS lookup attached.

It reads two free aggregators of the CT logs: crt.sh first (the richest index) and Cert Spotter as an automatic fallback when crt.sh is down. No proxies, no API key, no browser.

What data does Subdomain Finder extract?

Subdomain Finder extracts one row per hostname that has ever appeared in a publicly logged TLS certificate for your domain, plus live DNS state:

FieldTypeDescription
subdomainstring?Hostname found, e.g. docs.apify.com. null if the domain had no certificates
domainstring?The root domain from your input, or null if input validation failed
firstSeenstring?Earliest certificate notBefore date (ISO 8601 UTC), or null if no certs
lastSeenstring?Latest certificate notAfter date, or null if no certs
certificateCountinteger?Distinct certificates covering this hostname, or null if no certs
issuersarray?Certificate authorities, e.g. ["Let's Encrypt", "DigiCert Inc"], or null
isWildcardboolean?True for names like *.apify.com, or null if no data
resolvesboolean?True when the host returns an A record. null if DNS was off or failed
ipv4array?Current A records, or null if DNS was off or failed
cnamestring?First CNAME target — the classic subdomain-takeover signal, or null
sourcestring?crt.sh or certspotter, or null on error
errorstring?Why a domain returned nothing, e.g. No certificates found. null on success
scrapedAtstringRun timestamp (ISO 8601 UTC) — always present

How to use Subdomain Finder

  1. Paste your root domains into Domains. Bare domains and full URLs both work — https://www.apify.com/pricing is reduced to apify.com.
  2. Leave Resolve DNS on to separate live hosts from dead certificate records; turn it off for a pure certificate inventory.
  3. Set Max subdomains per domain (default 500). When the cap is hit, the hostnames with the most recently issued certificates are kept.
  4. Turn on Include wildcard names if you want *.example.com rows too, then click Start and export as JSON, CSV, Excel or HTML.

Example input

{
    "domains": ["apify.com", "github.com"],
    "resolveDns": true,
    "includeWildcards": false,
    "maxSubdomainsPerDomain": 500,
    "maxConcurrency": 5
}

Example output

{
    "subdomain": "api.mcp.github.com",
    "domain": "github.com",
    "firstSeen": "2025-08-22T00:00:00.000Z",
    "lastSeen": "2026-10-22T19:38:13.000Z",
    "certificateCount": 3,
    "issuers": ["DigiCert Inc", "Let's Encrypt"],
    "isWildcard": false,
    "resolves": true,
    "ipv4": ["140.82.113.22"],
    "cname": "glb-db52c2cf8be544.github.com",
    "source": "crt.sh",
    "error": null,
    "scrapedAt": "2026-09-12T15:48:11.438Z"
}

Input parameters

ParameterTypeDefaultDescription
domainsarray["apify.com"]Root domains to enumerate
resolveDnsbooleantrueA-record lookup per subdomain, fills resolves, ipv4, cname
includeWildcardsbooleanfalseAlso return *.example.com names
maxSubdomainsPerDomaininteger500Cap per domain (1–10,000), freshest certificates kept
maxConcurrencyinteger5Domains queried in parallel (1–20)

Pricing

Subdomain Finder uses pay-per-event pricing: $0.0005 per subdomain row — $0.50 per 1,000 subdomains — plus a negligible $0.00005 Actor-start fee, platform usage included. A typical mid-size company returns 30–120 rows, so a 100-domain portfolio audit costs roughly $2–6. Set Maximum cost per run to cap spend: the Actor trims its output to whatever your limit can pay for and never pushes an uncharged row.

Subdomain Finder vs. Amass and Subfinder

Amass and Subfinder are excellent CLIs, but they need a machine, a Go toolchain, config files and API keys for every data source before they return a single name. Subdomain Finder needs a domain in a text box. It runs on a schedule, stores every run as a queryable dataset that diffs cleanly against the previous one, and returns JSON over the API. For deep brute-force enumeration with dozens of paid sources, keep Amass; for fast, repeatable CT-log inventory across many domains, use this.

Using Subdomain Finder with AI agents and MCP

Subdomain Finder runs on pay-per-event pricing with limited permissions — the two requirements for an Actor to be callable through the Apify MCP server at mcp.apify.com. An agent passes domains and gets back a flat list of hostnames with live/dead status, which is exactly the shape a recon or asset-inventory agent needs. It also connects to n8n, Make, Zapier and LangChain through Apify's integrations.

FAQ

Does this find every subdomain? No, and no CT-based tool can. Certificate Transparency only shows hostnames that at some point received a publicly logged TLS certificate. Internal hosts on private CAs, plain-HTTP hosts, and names hidden behind a wildcard certificate never appear. Treat the output as a high-confidence floor, not a complete map.

Why are some rows resolves: false? The certificate exists in the logs but the DNS record is gone — a decommissioned staging host. Those rows are the interesting ones for attack-surface cleanup, and a dangling cname on a live record is the classic subdomain-takeover signal.

Why does source say certspotter? crt.sh returns HTTP 502 fairly often, especially for very large domains. The Actor retries it three times with backoff and then falls back to Cert Spotter automatically, so a run still returns data. Cert Spotter is rate-limited for anonymous use and returns a shallower history, so row counts can be lower.

Is this legal to run? Yes. Certificate Transparency logs are public, append-only and designed to be read; DNS lookups use Google's public resolver, and no personal data is collected.

Can I export as CSV or Excel? Yes, from the Output tab and the API.

Part of the webdatatools web-intelligence suite — every Actor is pay-per-event, reads public data without a login, and returns one clean row per entity:

Browse the whole suite at webdatatools, or call ten of these Actors straight from Claude, Cursor or Cline with the webdatatools MCP server.

Website & domain intelligence

Content for AI, LLMs and RAG

Search, video and social

Leads, jobs and company data

Developer, app and research data

Support and feedback

Missing a subdomain you know exists, or want another CT source added? Open an issue on the Issues tab.

You might also like

Subdomain Finder & Recon Tool avatar

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

User avatar

Andok

32

Subdomain Finder avatar

Subdomain Finder

happitap/subdomain-finder

Subdomain Finder is a high-speed intelligence tool that uncovers subdomains for any target domain using Certificate Transparency (CT) logs. Unlike traditional brute-force tools, it requires no heavy traffic and provides results in seconds.

User avatar

HappiTap

89

Subdomain Finder & Reverse IP avatar

Subdomain Finder & Reverse IP

canadesk/subdomain-finder-reverse-ip

Enumerate Subdomains and Reverse IPs with RapidDNS, Anubis, AlienVault and crt.sh! It's fast and costs little.

User avatar

Canadesk Support

235

Subdomain Finder — Certificate Transparency (crt.sh) avatar

Subdomain Finder — Certificate Transparency (crt.sh)

bgfc97/crtsh-subdomain-finder

Discover subdomains of any domain from public Certificate Transparency logs (crt.sh). Attack-surface mapping and recon with first/last-seen dates. No key, no proxy.

User avatar

Bruno

3

SF

Subdomain Finder, crt.sh Certificate Transparency Logs Search

snow_leo_data/crtsh-subdomain-finder

Subdomain finder past the crt.sh query limits: 7,236 subdomains of mercedes-benz.com where one crt.sh query returns 4. Certificate transparency logs search with duplicates merged, expiring and self-signed certificates flagged, and a watch mode for new certificates.

User avatar

Snow Leo Data

3

SC

SSL Certificate & Subdomain Finder for Any Website

scrapemint/ssl-subdomain-finder

Find all the subdomains of any website and check its SSL certificates. Paste a domain and get every subdomain seen in public certificate records, plus the certificate issuer, valid dates and days until expiry. Great for security checks and finding forgotten sites. No API key needed.

User avatar

Ken M

2

5.0

(2)

DA

Domain Attack Surface & Subdomain Scanner

cypherstone/domain-attack-surface-scanner

Find a domain's subdomains from Certificate Transparency logs, resolve each to its IP, and check the live SSL certificate (issuer, expiry, days left). Open-source recon, no API key.

User avatar

Jeff Ralston

2

SF

Subdomain Finder - Certificate Transparency & DNS

antishock/subdomain-finder-certificate-transparency

Enumerate subdomains of any domain from public Certificate Transparency logs and resolve each to IP or CNAME. Returns live status, certificate count, first and last seen dates, issuers and wildcard flag. For attack surface management, authorised recon and vendor discovery. No API key.

User avatar

Ryan Zinburg

2

CT

Certificate Transparency Subdomain Scraper

devilscrapes/crt-sh-certificate-transparency-scraper

Enumerate subdomains and audit certificate hygiene via crt.sh's public Certificate Transparency log — no API key. Get one row per certificate or unique subdomain with computed expiry, wildcard, and freshness signals, capped so a popular domain never blows your bill.

User avatar

DevilScrapes

2

IP

iTunes Podcast Snapshot

zentrafoundry/podcast-sponsor-prospect-finder

iTunes Search API podcast collections. Not extracted sponsors or host emails. $0.029 / show.

User avatar

Zentra

2