Pricing

Rating

Developer

Actor stats

Categories

Share

theHarvester Domain OSINT — Subdomains, Hosts, IPs & Emails

Run theHarvester — the standard open-source OSINT tool — on any domain, with zero setup and no API keys. Discover subdomains, hosts, IPs and emails gathered from free public sources.

Built for security recon, attack-surface mapping, penetration testing (authorized), and due diligence.

This Actor wraps the open-source theHarvester (GPL-2.0) and is not affiliated with the original project. It queries only free, key-free public sources. Use only on domains you own or are authorized to investigate. Comply with GDPR, PIPA, CCPA and applicable laws.

Why this Actor

• theHarvester, zero setup — no install, no API keys, no config
• Free public sources — crt.sh, Certspotter, HackerTarget, DuckDuckGo, and more
• Subdomain & host discovery — map a domain's public footprint fast
• Bulk — up to 10 domains per run
• Structured JSON — hosts, IPs, emails separated and de-duplicated
• Pay per result — $0.05 per domain investigated. No subscription.

Input

{
"domains":["example.com"],
"sources":["crtsh","certspotter","hackertarget"],
"limit":200
}

Output

One dataset item per domain: domain, hostCount, ipCount, emailCount, hosts, ips, emails, sourcesUsed, errors, scannedAt.

Use cases

• Attack-surface mapping — enumerate subdomains and hosts of an in-scope target
• Security recon — initial footprinting phase of an authorized engagement
• M&A / vendor due diligence — understand a company's external infrastructure
• Brand monitoring — track subdomains appearing in public sources

A note on sources

Sources that require paid/registered API keys (Shodan, Hunter, IntelX, Brave, Censys, etc.) are not included — this Actor is designed to work out of the box with free sources only. Some sources may rate-limit or return partial data; errors are reported per run in the errors field.

Disclaimer

For informational and authorized security purposes only. Not legal advice. Results come from public sources and may contain false positives. The operator is not responsible for misuse or for decisions made from these results.