Pricing

Rating

Developer

Actor stats

Categories

Share

Subdomain Finder (CT Logs + DNS)

Map the full attack surface of any domain by discovering subdomains through certificate transparency logs and optional DNS brute-force. Security audits and penetration tests start with knowing what is exposed — yet manual subdomain enumeration is slow and incomplete. Scan multiple domains in bulk with configurable concurrency and get structured results ready for downstream security tools.

Features

• Certificate transparency — queries crt.sh to find subdomains from publicly issued TLS certificates
• DNS brute-force — optional wordlist-based subdomain discovery for common names like api, staging, admin
• Bulk scanning — process multiple root domains in a single run
• Configurable concurrency — control parallel lookups from 1 to 25 simultaneous queries
• Source tracking — reports how many subdomains came from each discovery method
• Custom wordlists — extend or replace the default brute-force wordlist with your own terms
• Charge limit support — respects the Apify max charge per run to control costs

Input

Input Example

{
"domains":["example.com","example.org"],
"useCertificateTransparency":true,
"useDnsBruteforce":true,
"concurrency":10
}

Output

Each root domain produces one dataset item with all discovered subdomains and source counts.

Key fields:

• domain (string) — the root domain that was scanned
• subdomainCount (integer) — total number of unique subdomains found
• subdomains (array) — sorted list of all discovered subdomains
• sources (object) — count of subdomains found per method (crtsh, dnsBruteforce)
• checkedAt (string) — ISO 8601 timestamp of the scan
• error (string | null) — any issues encountered during the scan

Output Example

{
"domain":"example.com",
"subdomainCount":12,
"subdomains":[
"api.example.com",
"blog.example.com",
"cdn.example.com",
"dev.example.com",
"mail.example.com",
"staging.example.com",
"status.example.com",
"support.example.com",
"vpn.example.com",
"wiki.example.com",
"www.example.com",
"zabbix.example.com"
],
"sources":{
"crtsh":10,
"dnsBruteforce":4
},
"checkedAt":"2025-03-09T14:30:00.000Z",
"error":null
}

Pricing

Set ACTOR_MAX_TOTAL_CHARGE_USD to control maximum spending per run.

Use Cases

• Penetration testing reconnaissance — discover all exposed subdomains before beginning a security assessment
• Attack surface management — schedule weekly scans to detect new or unauthorized subdomains as they appear
• Brand protection — find subdomains that may have been forgotten, misconfigured, or hijacked
• Certificate audit preparation — enumerate subdomains to feed into SSL certificate monitoring
• Infrastructure inventory — build a complete map of subdomains across multiple client domains for MSPs and agencies

Related Actors

Notes

• Certificate transparency results depend on crt.sh availability. If crt.sh is temporarily down, the actor logs the error and continues with DNS brute-force if enabled.
• DNS brute-force only checks the provided wordlist — it does not perform exhaustive enumeration. Extend bruteforceWords for deeper coverage.