Search

Find Subdomains from a company name

Company NameSubdomain

Have a company name? These OSINT tools take a company name as input and return subdomains. 10 tools in our catalogue make this exact pivot — compare them by pricing, platform, and what they output, then chain the results into the next step of your investigation.

10tools
All Company Name tools
Recon-ng icon

Recon-ng

Modular web reconnaissance framework

FreeOSSCLI
IN+5
OUT+1
theHarvester icon

theHarvester

Collect emails and subdomains from public sources

FreeOSSCLI
IN
OUT+1
Cloudlist icon

Cloudlist

Cloud-provider asset enumerator

FreeOSSCLI
IN
OUT
FullHunt icon

FullHunt

Attack-surface platform mapping a domain's exposed subdomains, IPs and services

FreemiumWebAPI
IN
OUT+2
MicroBurst icon

MicroBurst

Enumerate public Azure services and storage for a tenant

FreeOSSCLI
IN
OUT
OWASP ASST icon

OWASP ASST

OWASP Amass companion utilities

FreeOSSCLI
IN
OUT
Palo Alto Cortex Xpanse icon

Palo Alto Cortex Xpanse

Palo Alto EASM and exposure platform

PaidWebAPI
IN
OUT
RedHunt Labs Attack Surface icon

RedHunt Labs Attack Surface

Discover an organisation's external attack surface from a domain

PaidWebAPI
IN
OUT
Tenable Attack Surface Management icon

Tenable Attack Surface Management

Tenable enterprise attack-surface platform

PaidWebAPI
IN
OUT
Wiz Cloud Attack Surface Management icon

Wiz Cloud Attack Surface Management

Wiz cloud-native security platform

PaidWebAPI
IN
OUT

From company name, also find…

Business Relationships93Company Registration66Report / Summary61Financial Records40Court Records24Employee List22Physical Address16Data Breach Records12

Find subdomain from other data

Domain Name63IP Address12DNS Records6Email Address5WHOIS Data5
All OSINT use cases & data types