Subdomain Finder - Certificate Transparency + DNS Check
Pricing
from $2.00 / 1,000 subdomains
Subdomain Finder - Certificate Transparency + DNS Check
Find all subdomains of any domain from public Certificate Transparency logs (crt.sh, Cert Spotter fallback) with first-seen date, cert count, issuers and live DNS/IP check. Passive OSINT, no port scanning. For security teams and bug bounty. $2 per 1,000 subdomains.
Pricing
from $2.00 / 1,000 subdomains
Rating
0.0
(0)
Developer
leo zhu
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
a day ago
Last modified
Categories
Share
Subdomain Finder - Certificate Transparency (crt.sh) + DNS Check
Find all known subdomains of any domain from public Certificate Transparency (CT) logs - every TLS certificate issued since ~2013 is logged publicly - and check which ones are still live in DNS. Uses crt.sh (full history) with automatic fallback to Cert Spotter when crt.sh is slow or down. 100% passive: no brute force, no port scanning, no login.
Who uses it
- Security teams & pentesters: map the external attack surface, spot forgotten staging / admin / dev hosts.
- Bug bounty hunters: fast recon for many targets in one run, scheduled to catch new subdomains.
- IT & compliance: inventory company assets and certificates, find certs about to expire and which CAs are used.
- Sales & market research: see which SaaS a company runs (status., shop., help., jira., vpn. ...) and when new products went live (first certificate date).
- Domain investors & SEO: discover all sites under a brand.
Input
| Field | Description |
|---|---|
domains | Root domains (URLs are cleaned). |
source | auto (default), crtsh, certspotter or both. |
resolveDns | Resolve each subdomain and return IPs. |
onlyResolving | Return only live subdomains (dead ones are not charged). |
includeExpired | Use expired certificates too (finds old hosts). |
includeWildcards | Keep *.example.com rows. |
maxSubdomainsPerDomain | Default 1000. |
Output (one row per subdomain)
A RUN_SUMMARY record (counts per source, failures) is saved in the key-value store.
Pricing (pay per event)
- $0.002 per subdomain saved (
subdomain) - $2 per 1,000. - Tiny start fee per run (
apify-actor-start). - Invalid / failed domains and subdomains skipped by
onlyResolvingare not charged. Set "Maximum cost per run" to cap spend.
Notes
- Only hostnames that ever appeared in a public TLS certificate are found (internal hosts without public certs and hosts covered only by a wildcard certificate are not visible in CT logs).
- crt.sh is a free community service and can be slow for very large domains (e.g. google.com); the Actor retries and falls back to Cert Spotter (current certificates only, free anonymous quota). Not affiliated with Sectigo (crt.sh) or SSLMate (Cert Spotter).
- Use responsibly and only for assets you are allowed to assess.
FAQ
Does it scan or brute-force? No - it only reads public CT logs and does normal DNS lookups.
Can I monitor for new subdomains? Yes - schedule it and compare firstCertSeen with your last run.
