Pricing

from $0.30 / 1,000 results

Try for free

Go to Apify Store

Subdomain Finder (Certificate Transparency)

Try for free

Subdomain Finder enumerates every subdomain of a domain from Certificate Transparency logs (crt.sh, Cert Spotter) and resolves each one — one row per subdomain, no proxies needed.

Pricing

from $0.30 / 1,000 results

Rating

0.0

(0)

Developer

Murat Uzun

Actor stats

Bookmarked

Total users

Monthly active users

21 hours ago

Last modified

Categories

Developer tools

SEO tools

Automation

Domains

domains

Required

Enter the root domains to enumerate subdomains for, e.g. apify.com. Bare domains and full URLs both work — https://www.apify.com/pricing is reduced to apify.com. One row is returned per subdomain found.

Type:array

Default:

[
  "apify.com"
]

Resolve DNS

resolveDns

Optional

Turn this on to look up an A record for every subdomain found, so you can tell live hosts from dead certificate records. Costs one extra DNS query per subdomain and fills in resolves, ipv4 and cname. Turn it off for a pure certificate list.

Type:boolean

Default:true

Include wildcard names

includeWildcards

Optional

Turn this on to also return wildcard certificate names such as *.example.com. They cannot be resolved, so they are excluded by default.

Type:boolean

Default:false

Max subdomains per domain

maxSubdomainsPerDomain

Optional

Enter the maximum number of subdomains to return per domain, e.g. 500. Big brands have thousands of certificate names; when the cap is hit the subdomains with the most recently issued certificates are kept.

Type:integer

Minimum:1

Maximum:10000

Default:500

Max concurrency

maxConcurrency

Optional

Enter how many domains to query in parallel, e.g. 5. crt.sh rate-limits and times out under load, so keep this low for long domain lists.

Type:integer

Minimum:1

Maximum:20

Default:5

Subdomain Finder — Certificate Transparency (crt.sh)

bgfc97/crtsh-subdomain-finder

Discover subdomains of any domain from public Certificate Transparency logs (crt.sh). Attack-surface mapping and recon with first/last-seen dates. No key, no proxy.

Bruno

Subdomain Finder – Certificate Transparency

datascraperes/crt-name-subdomain-finder

Find unique subdomains for up to 10,000 domains from live Certificate Transparency records. Normalize URLs, remove wildcard and duplicate hostnames, export structured results, and automate passive asset discovery through the Apify API.

DataScraperES

Subdomain Finder — Certificate Transparency Search

accountable_eel/subdomain-discovery-lookup

Enumerate any domain's real subdomains from the free, public Certificate Transparency log API (certspotter) — no login, no scraping. Every subdomain returned had an actual TLS certificate issued for it. Pay only when subdomains are found; domains with no CT history cost nothing.

Adrian Voss

Subdomain Finder: Certificate Transparency

glitchbound/subdomain-scraper

Enumerate every subdomain of a domain from public Certificate Transparency logs. No brute-force wordlist and no DNS hammering, because every TLS certificate is logged, so the hosts are already public record. Deduplicated to one row per hostname, with first seen, issuing CA and current validity.

Daniel Meshulam

Subdomain Finder

mina_safwat/subdomain-finder

Finds every subdomain of a domain from public certificate transparency logs — thousands in under a second, without touching the target

Mina

Internet Infrastructure Data: Networks, IP Ranges, Peering

scrapemint/internet-infrastructure-data

Keyless global routing data. Give a network number, an IP address or a country code and get the holder, every IP range they announce with its size, the networks they peer with marked upstream or downstream, and how long they have been visible in the global routing table.

Ken M

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Logiover

Bulk domain WHOIS, DNS, SSL, and tech stack in one call

shipsatnight/domain-intelligence-suite

Point it at a list of domains. Get registrar/age, DNS, a real TLS handshake, and detectable tech — pay only for modules that return. No browser, no proxy bill.

Donovan

🌐 DNS Propagation Checker

taroyamada/dns-propagation-checker

Query up to 200 domains across 8 global resolvers to extract A, NS, and SOA records and audit worldwide nameserver propagation instantly.

naoki anzai

CSV Cleaner & Deduplication Tool

taroyamada/csv-data-cleaner

Clean user-supplied CSV tables by trimming whitespace, removing empty rows, deduplicating selected columns, and sorting records without external data collection.

naoki anzai