Search

Find Subdomains of a Domain

Domain NameSubdomain

Have a domain? These OSINT tools take a domain as input and return subdomains. 63 tools in our catalogue make this exact pivot — compare them by pricing, platform, and what they output, then chain the results into the next step of your investigation.

63tools
All Domain Name tools
OWASP Amass icon

OWASP Amass

Attack-surface mapping and DNS enumeration

FreeOSSCLI
IN
OUT+1
Recon-ng icon

Recon-ng

Modular web reconnaissance framework

FreeOSSCLI
IN+5
OUT+1
SecurityTrails icon

SecurityTrails

DNS history and domain intelligence platform

FreemiumWebAPI
IN
OUT+1
SpiderFoot icon

SpiderFoot

Automated OSINT reconnaissance framework

FreeOSSWebCLI
IN+13
OUT+3
theHarvester icon

theHarvester

Collect emails and subdomains from public sources

FreeOSSCLI
IN
OUT+1
ALterX icon

ALterX

Subdomain permutation generator by ProjectDiscovery

FreeOSSCLI
IN
OUT
Altdns icon

Altdns

a subdomain permutation tool that generates altered hostnames for DNS brute f

FreeOSSCLI
IN
OUT
Assetfinder icon

Assetfinder

a command-line tool for finding domains and subdomains related to a target or

FreeOSSCLI
IN
OUT
AttackSurfaceMapper icon

AttackSurfaceMapper

Recon CLI chaining LinkedIn, Shodan, screenshots

FreeOSSCLI
IN
OUT
BBOT icon

BBOT

Recursive multi-source recon scanner

FreeOSSCLI
IN
OUT
BeVigil icon

BeVigil

Mobile-app security search engine surfacing APK secrets, keys and subdomains

FreemiumWebAPI
IN
OUT+1
BeVigil OSINT CLI icon

BeVigil OSINT CLI

Query BeVigil API for hosts, subdomains and S3 buckets from apps and domains

FreemiumOSSCLIAPI
IN
OUT
CertKit CT Log Search icon

CertKit CT Log Search

Search Certificate Transparency logs by domain for subdomains

FreemiumWeb
IN
OUT
Certspotter icon

Certspotter

Certificate Transparency monitoring service

FreemiumOSSCLIWeb
IN
OUT
Chaos icon

Chaos

Curated bug-bounty subdomain dataset

FreemiumOSSWebAPI
IN
OUT
CloudFail icon

CloudFail

Find the origin IP of a Cloudflare-protected domain

FreeOSSCLI
IN
OUT
Columbus Project icon

Columbus Project

Fast subdomain enumeration from CT logs and DNS, API-first

FreeOSSAPIWeb
IN
OUT
DMNS icon

DMNS

Domain reconnaissance and DNS lookup tool

FreemiumWeb
IN
OUT
DNSDumpster icon

DNSDumpster

Passive DNS and subdomain reconnaissance

FreeWeb
IN
OUT
DNSLytics icon

DNSLytics

Reverse-DNS and SSL pivoting platform

FreemiumWebAPI
IN
OUT
DNSReaper icon

DNSReaper

Subdomain takeover detection scanner

FreeOSSWebCLI
IN
OUT
DNSRecon icon

DNSRecon

a DNS enumeration script for records, zone transfers, brute force, and cache

FreeOSSCLI
IN
OUT
DNSValidator icon

DNSValidator

a resolver validation tool used to build reliable DNS resolver lists for reco

FreeOSSCLI
IN
OUT
DNScan icon

DNScan

Python DNS bruteforce and AXFR tester

FreeOSSCLI
IN
OUT
Detectify icon

Detectify

EASM scanner with crowdsourced signatures

PaidWebAPI
IN
OUT
Driftnet icon

Driftnet

Internet-scan intelligence for domains and IPs

FreemiumWebAPI
IN
OUT+2
Fierce icon

Fierce

a DNS reconnaissance tool for locating non-contiguous IP space and related ho

FreeOSSCLI
IN
OUT
Findomain icon

Findomain

a cross-platform subdomain enumerator using certificate transparency and publ

FreeOSSCLI
IN
OUT
FullHunt icon

FullHunt

Attack-surface platform mapping a domain's exposed subdomains, IPs and services

FreemiumWebAPI
IN
OUT+2
Gotator icon

Gotator

a permutation generator for creating candidate subdomains during discovery wo

FreeOSSCLI
IN
OUT
HackerTarget icon

HackerTarget

Free recon tools (DNS, ports, headers, WHOIS)

FreemiumWebAPI
IN
OUT
Knock icon

Knock

Python subdomain bruteforce and passive scan

FreeOSSCLI
IN
OUT
MassDNS icon

MassDNS

a high-performance DNS stub resolver for large-scale host and subdomain valid

FreeOSSCLI
IN
OUT
MicroBurst icon

MicroBurst

Enumerate public Azure services and storage for a tenant

FreeOSSCLI
IN
OUT
Netlas.io icon

Netlas.io

Internet scan search engine for hosts, DNS, certs and WHOIS

FreemiumWebAPI
IN
OUT+3
OWASP ASST icon

OWASP ASST

OWASP Amass companion utilities

FreeOSSCLI
IN
OUT
PassiveTotal Project Crystal Ball icon

PassiveTotal Project Crystal Ball

Free Certificate Transparency archive search

FreemiumWebAPI
IN
OUT
Project Discovery Nuclei Cloud icon

Project Discovery Nuclei Cloud

Hosted SaaS for ProjectDiscovery scanners

FreemiumWebAPI
IN
OUT
RapidDNS icon

RapidDNS

DNS records, subdomains, and reverse-IP lookup

FreeWeb
IN
OUT
RedHunt Labs Attack Surface icon

RedHunt Labs Attack Surface

Discover an organisation's external attack surface from a domain

PaidWebAPI
IN
OUT
Sectigo Certificate Search icon

Sectigo Certificate Search

Censys searchable Certificate Transparency log

FreemiumWebAPI
IN
OUT
SecurityTrails Historical DNS icon

SecurityTrails Historical DNS

SecurityTrails deep DNS history

FreemiumWebAPI
IN
OUT
Sn1per icon

Sn1per

Automated recon and pentest framework

FreemiumOSSCLI
IN
OUT
SpiderSuite icon

SpiderSuite

Cross-platform GUI web crawler for recon and attack-surface mapping

FreeOSSDesktop App
IN
OUT
Subdomainizer icon

Subdomainizer

Static JS subdomain and bucket extractor

FreeOSSCLI
IN
OUT
Subfinder icon

Subfinder

a passive subdomain discovery tool that queries many public data sources

FreeOSSCLI
IN
OUT
Sublert icon

Sublert

Subdomain CT-log monitor (legacy)

FreeOSSCLI
IN
OUT
Sublist3r icon

Sublist3r

Enumerate subdomains from public sources

FreeOSSCLI
IN
OUT
Synapsint icon

Synapsint

All-in-one OSINT aggregator for domains, IPs, and emails

FreemiumWeb
IN+1
OUT+1
URLCrazy icon

URLCrazy

a domain typo and homoglyph generator for finding spoofed or suspicious looka

FreeOSSCLI
IN
OUT
WhoisXML API icon

WhoisXML API

Commercial WHOIS and domain-research APIs

FreemiumWebAPI
IN
OUT
crt.sh icon

crt.sh

Free Certificate Transparency log search

FreeWebAPI
IN
OUT
dnsenum icon

dnsenum

a DNS enumeration tool for discovering name servers, MX records, subdomains,

FreeOSSCLI
IN
OUT
dnstwist icon

dnstwist

a domain permutation tool for detecting typosquatting, phishing, and brand im

FreeOSSCLI
IN
OUT
dnsx icon

dnsx

a DNS toolkit for resolving, filtering, and validating domain and subdomain r

FreeOSSCLI
IN
OUT
gospider icon

gospider

Fast Go web crawler for ASM

FreeOSSCLI
IN
OUT
puredns icon

puredns

a fast domain resolver and bruteforcing tool built around massdns for large r

FreeOSSCLI
IN
OUT
reNgine icon

reNgine

Automated recon framework with web UI

FreeOSSWebCLI
IN
OUT
reconFTW icon

reconFTW

Automated domain recon: subdomains, web probing, OSINT and vuln scan

FreeOSSCLI
IN
OUT
shuffledns icon

shuffledns

a DNS brute forcing and resolution wrapper designed for large-scale subdomain

FreeOSSCLI
IN
OUT

From domain name, also find…

Report / Summary110IOC (Indicator of Compromise)104DNS Records72URL65Technology Stack47Website42CVE / Vulnerability38WHOIS Data37

Find subdomain from other data

IP Address12Company Name10DNS Records6Email Address5WHOIS Data5
All OSINT use cases & data types