# Subdomain Finder (Certificate Transparency) (`webdatatools/subdomain-finder`) Actor Subdomain Finder enumerates every subdomain of a domain from Certificate Transparency logs (crt.sh, Cert Spotter) and resolves each one — one row per subdomain, no proxies needed. - **URL**: https://apify.com/webdatatools/subdomain-finder.md - **Developed by:** [Murat Uzun](https://apify.com/webdatatools) (community) - **Categories:** Developer tools, SEO tools, Automation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $0.30 / 1,000 results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. - **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use). - **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`. - **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`. - **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`. - **Any other language** — the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ### What is Subdomain Finder? Subdomain Finder is an Apify Actor that enumerates every subdomain of a domain from the public **Certificate Transparency (CT) logs** and tells you which ones are still alive. Give it `apify.com` and you get back `docs.apify.com`, `console.apify.com`, `staging.apify.com`, forgotten `dev-` and `test-` hosts — **one clean row per subdomain**, with the certificate history and a fresh DNS lookup attached. It reads two free aggregators of the CT logs: **crt.sh** first (the richest index) and **Cert Spotter** as an automatic fallback when crt.sh is down. No proxies, no API key, no browser. ### What data does Subdomain Finder extract? Subdomain Finder extracts one row per hostname that has ever appeared in a publicly logged TLS certificate for your domain, plus live DNS state: | Field | Type | Description | | ------------------ | ------- | ------------------------------------------------------------------------------- | | `subdomain` | string? | Hostname found, e.g. `docs.apify.com`. `null` if the domain had no certificates | | `domain` | string? | The root domain from your input, or `null` if input validation failed | | `firstSeen` | string? | Earliest certificate `notBefore` date (ISO 8601 UTC), or `null` if no certs | | `lastSeen` | string? | Latest certificate `notAfter` date, or `null` if no certs | | `certificateCount` | integer? | Distinct certificates covering this hostname, or `null` if no certs | | `issuers` | array? | Certificate authorities, e.g. `["Let's Encrypt", "DigiCert Inc"]`, or `null` | | `isWildcard` | boolean? | True for names like `*.apify.com`, or `null` if no data | | `resolves` | boolean? | True when the host returns an A record. `null` if DNS was off or failed | | `ipv4` | array? | Current A records, or `null` if DNS was off or failed | | `cname` | string? | First CNAME target — the classic subdomain-takeover signal, or `null` | | `source` | string? | `crt.sh` or `certspotter`, or `null` on error | | `error` | string? | Why a domain returned nothing, e.g. `No certificates found`. `null` on success | | `scrapedAt` | string | Run timestamp (ISO 8601 UTC) — always present | ### How to use Subdomain Finder 1. Paste your root domains into **Domains**. Bare domains and full URLs both work — `https://www.apify.com/pricing` is reduced to `apify.com`. 2. Leave **Resolve DNS** on to separate live hosts from dead certificate records; turn it off for a pure certificate inventory. 3. Set **Max subdomains per domain** (default 500). When the cap is hit, the hostnames with the most recently issued certificates are kept. 4. Turn on **Include wildcard names** if you want `*.example.com` rows too, then click **Start** and export as JSON, CSV, Excel or HTML. ### Example input ```json { "domains": ["apify.com", "github.com"], "resolveDns": true, "includeWildcards": false, "maxSubdomainsPerDomain": 500, "maxConcurrency": 5 } ``` ### Example output ```json { "subdomain": "api.mcp.github.com", "domain": "github.com", "firstSeen": "2025-08-22T00:00:00.000Z", "lastSeen": "2026-10-22T19:38:13.000Z", "certificateCount": 3, "issuers": ["DigiCert Inc", "Let's Encrypt"], "isWildcard": false, "resolves": true, "ipv4": ["140.82.113.22"], "cname": "glb-db52c2cf8be544.github.com", "source": "crt.sh", "error": null, "scrapedAt": "2026-09-12T15:48:11.438Z" } ``` ### Input parameters | Parameter | Type | Default | Description | | ------------------------ | ------- | --------------- | ---------------------------------------------------------------- | | `domains` | array | `["apify.com"]` | Root domains to enumerate | | `resolveDns` | boolean | `true` | A-record lookup per subdomain, fills `resolves`, `ipv4`, `cname` | | `includeWildcards` | boolean | `false` | Also return `*.example.com` names | | `maxSubdomainsPerDomain` | integer | 500 | Cap per domain (1–10,000), freshest certificates kept | | `maxConcurrency` | integer | 5 | Domains queried in parallel (1–20) | ### Pricing Subdomain Finder uses pay-per-event pricing: **$0.0005 per subdomain row** — **$0.50 per 1,000 subdomains** — plus a negligible $0.00005 Actor-start fee, platform usage included. A typical mid-size company returns 30–120 rows, so a 100-domain portfolio audit costs roughly $2–6. Set **Maximum cost per run** to cap spend: the Actor trims its output to whatever your limit can pay for and never pushes an uncharged row. ### Subdomain Finder vs. Amass and Subfinder Amass and Subfinder are excellent CLIs, but they need a machine, a Go toolchain, config files and API keys for every data source before they return a single name. Subdomain Finder needs a domain in a text box. It runs on a schedule, stores every run as a queryable dataset that diffs cleanly against the previous one, and returns JSON over the API. For deep brute-force enumeration with dozens of paid sources, keep Amass; for fast, repeatable CT-log inventory across many domains, use this. ### Using Subdomain Finder with AI agents and MCP Subdomain Finder runs on pay-per-event pricing with limited permissions — the two requirements for an Actor to be callable through the Apify MCP server at `mcp.apify.com`. An agent passes `domains` and gets back a flat list of hostnames with live/dead status, which is exactly the shape a recon or asset-inventory agent needs. It also connects to n8n, Make, Zapier and LangChain through Apify's integrations. ### FAQ **Does this find every subdomain?** No, and no CT-based tool can. Certificate Transparency only shows hostnames that at some point received a **publicly logged TLS certificate**. Internal hosts on private CAs, plain-HTTP hosts, and names hidden behind a wildcard certificate never appear. Treat the output as a high-confidence floor, not a complete map. **Why are some rows `resolves: false`?** The certificate exists in the logs but the DNS record is gone — a decommissioned staging host. Those rows are the interesting ones for attack-surface cleanup, and a dangling `cname` on a live record is the classic subdomain-takeover signal. **Why does `source` say `certspotter`?** crt.sh returns HTTP 502 fairly often, especially for very large domains. The Actor retries it three times with backoff and then falls back to Cert Spotter automatically, so a run still returns data. Cert Spotter is rate-limited for anonymous use and returns a shallower history, so row counts can be lower. **Is this legal to run?** Yes. Certificate Transparency logs are public, append-only and designed to be read; DNS lookups use Google's public resolver, and no personal data is collected. **Can I export as CSV or Excel?** Yes, from the Output tab and the API. ### Related Actors Part of the **webdatatools** web-intelligence suite — every Actor is pay-per-event, runs without proxies or a headless browser, and returns one clean row per entity: **Website & domain intelligence** - [Website Contact & Social Extractor](https://apify.com/webdatatools/contact-extractor) — e-mails, phones and social profiles per domain - [Website Tech Stack Detector](https://apify.com/webdatatools/tech-stack-detector) — CMS, e-commerce, analytics, pixels and payments per domain - [Domain DNS & Email Security Checker](https://apify.com/webdatatools/dns-email-security-checker) — SPF, DKIM, DMARC, MX provider, registrar and domain age - [Domain Security Audit](https://apify.com/webdatatools/domain-security-audit) — TLS expiry, security headers, redirect chain, robots and llms.txt - [Bulk Core Web Vitals & PageSpeed Audit](https://apify.com/webdatatools/core-web-vitals-audit) — Lighthouse scores, LCP, CLS, INP and top fixes per URL - [On-Page SEO Audit](https://apify.com/webdatatools/seo-page-audit) — title, meta, headings, links, images and schema issues per page - [Sitemap URL Extractor & Change Monitor](https://apify.com/webdatatools/sitemap-extractor) — every sitemap URL, or new and removed pages between runs - [Wayback Machine Snapshot & Page Change Tracker](https://apify.com/webdatatools/wayback-page-diff) — how a page changed over time, or every archived snapshot **Content for AI, LLMs and RAG** - [AI Web Search & Read](https://apify.com/webdatatools/ai-web-search) — a query turned into clean Markdown from the top search results - [Website to Markdown Crawler for LLM & RAG](https://apify.com/webdatatools/website-to-markdown) — any site as clean Markdown per page, no browser - [Article & News Extractor](https://apify.com/webdatatools/article-extractor) — clean article text, author, date and Markdown per URL - [Structured Data & JSON-LD Extractor](https://apify.com/webdatatools/structured-data-extractor) — Schema.org and Open Graph data from any page - [Google News Scraper](https://apify.com/webdatatools/google-news-scraper) — news results by keyword, topic or site - [Press Release Monitor](https://apify.com/webdatatools/press-release-monitor) — PR Newswire, Business Wire and GlobeNewswire releases **Search, video and social** - [Google Search Results Scraper](https://apify.com/webdatatools/google-search-scraper) — organic SERP results per keyword and country - [YouTube Comments Scraper](https://apify.com/webdatatools/youtube-comments-scraper) — comments and replies with likes, no API key - [YouTube Channel Latest Videos](https://apify.com/webdatatools/youtube-channel-videos) — the latest 15 videos of any channel from RSS - [YouTube Channel Videos Scraper](https://apify.com/webdatatools/youtube-channel-scraper) — a channel's full video, shorts and stream list - [YouTube Search Results Scraper](https://apify.com/webdatatools/youtube-search-scraper) — videos, channels and playlists per query - [YouTube Video Details Scraper](https://apify.com/webdatatools/youtube-video-details) — views, likes, description, tags and chapters per video - [Apple Podcasts Lookup & Episodes Scraper](https://apify.com/webdatatools/podcast-lookup) — podcast metadata and episodes from iTunes and RSS - [Bluesky Scraper](https://apify.com/webdatatools/bluesky-scraper) — posts, profiles, followers and threads from the AT Protocol API **Leads, jobs and company data** - [Company 360](https://apify.com/webdatatools/company-360) — one row per domain: contacts, tech, security, hiring and company facts - [Hiring Signals Scraper](https://apify.com/webdatatools/hiring-signals) — open jobs and hiring velocity from 10 public ATS boards - [Y Combinator Companies & Founders Scraper](https://apify.com/webdatatools/yc-companies-scraper) — YC startups by batch, industry and hiring status - [Wikidata Entity & Company Enrichment](https://apify.com/webdatatools/wikidata-entity-enrichment) — HQ, founders, employees, revenue and social IDs per company - [Bulk Email Validator](https://apify.com/webdatatools/email-validator) — syntax, MX, disposable, role and free-provider checks - [OpenStreetMap POI Extractor](https://apify.com/webdatatools/overpass-poi-extractor) — shops and amenities by radius, bbox or area **Developer, app and research data** - [npm, PyPI & Crates.io Package Health Checker](https://apify.com/webdatatools/package-health-checker) — releases, downloads, deprecation and a health score - [GitHub Repository Health & Activity Report](https://apify.com/webdatatools/github-repo-health) — stars, commits, contributors and risk flags per repo - [VS Code Marketplace Extension Scraper](https://apify.com/webdatatools/vscode-marketplace-extensions) — installs, ratings and versions per extension - [Chrome Web Store Extension Scraper](https://apify.com/webdatatools/chrome-web-store-extensions) — users, rating, version and developer per extension - [Google Play Store Scraper](https://apify.com/webdatatools/google-play-scraper) — apps, ratings, installs, developer contact and reviews - [App Store (iOS) App Metadata & Top Charts](https://apify.com/webdatatools/app-store-lookup) — ratings, price, version and charts per app - [CrossRef DOI & Citation Metadata Lookup](https://apify.com/webdatatools/crossref-doi-lookup) — papers, authors, journals and citation counts - [FDA Recalls & Adverse Events Monitor](https://apify.com/webdatatools/openfda-recall-monitor) — food, drug and device recalls from openFDA - [iCal / ICS Calendar Feed to Events Extractor](https://apify.com/webdatatools/ical-calendar-extractor) — any public calendar feed as event rows - [Shopify Store Products Scraper](https://apify.com/webdatatools/shopify-products-scraper) — catalog, prices, variants and stock per store ### Support and feedback Missing a subdomain you know exists, or want another CT source added? Open an issue on the **Issues** tab. # Actor input Schema ## `domains` (type: `array`): Enter the root domains to enumerate subdomains for, e.g. apify.com. Bare domains and full URLs both work — https://www.apify.com/pricing is reduced to apify.com. One row is returned per subdomain found. ## `resolveDns` (type: `boolean`): Turn this on to look up an A record for every subdomain found, so you can tell live hosts from dead certificate records. Costs one extra DNS query per subdomain and fills in resolves, ipv4 and cname. Turn it off for a pure certificate list. ## `includeWildcards` (type: `boolean`): Turn this on to also return wildcard certificate names such as \*.example.com. They cannot be resolved, so they are excluded by default. ## `maxSubdomainsPerDomain` (type: `integer`): Enter the maximum number of subdomains to return per domain, e.g. 500. Big brands have thousands of certificate names; when the cap is hit the subdomains with the most recently issued certificates are kept. ## `maxConcurrency` (type: `integer`): Enter how many domains to query in parallel, e.g. 5. crt.sh rate-limits and times out under load, so keep this low for long domain lists. ## Actor input object example ```json { "domains": [ "apify.com", "github.com" ], "resolveDns": true, "includeWildcards": false, "maxSubdomainsPerDomain": 500, "maxConcurrency": 5 } ``` # Actor output Schema ## `subdomains` (type: `string`): All discovered subdomains — download as JSON, CSV, Excel or HTML. # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "apify.com", "github.com" ], "resolveDns": true, "includeWildcards": false, "maxSubdomainsPerDomain": 500, "maxConcurrency": 5 }; // Run the Actor and wait for it to finish const run = await client.actor("webdatatools/subdomain-finder").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": [ "apify.com", "github.com", ], "resolveDns": True, "includeWildcards": False, "maxSubdomainsPerDomain": 500, "maxConcurrency": 5, } # Run the Actor and wait for it to finish run = client.actor("webdatatools/subdomain-finder").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "apify.com", "github.com" ], "resolveDns": true, "includeWildcards": false, "maxSubdomainsPerDomain": 500, "maxConcurrency": 5 }' | apify call webdatatools/subdomain-finder --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,webdatatools/subdomain-finder" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/UDB3k0SyLCgRgtAqY/builds/SvFNPVsTAUaavgB2k/openapi.json