Search

Find Subdomains from an email address

Email AddressSubdomain

Have an email address? These OSINT tools take an email address as input and return subdomains. 5 tools in our catalogue make this exact pivot — compare them by pricing, platform, and what they output, then chain the results into the next step of your investigation.

5tools
All Email Address tools
Recon-ng icon

Recon-ng

Modular web reconnaissance framework

FreeOSSCLI
IN+5
OUT+1
SpiderFoot icon

SpiderFoot

Automated OSINT reconnaissance framework

FreeOSSWebCLI
IN+13
OUT+3
Synapsint icon

Synapsint

All-in-one OSINT aggregator for domains, IPs, and emails

FreemiumWeb
IN+1
OUT+1
WhoisXML API icon

WhoisXML API

Commercial WHOIS and domain-research APIs

FreemiumWebAPI
IN
OUT
sn0int icon

sn0int

Modular semi-automatic OSINT framework with a sandboxed module registry

FreeOSSCLI
IN+1
OUT+2

From email address, also find…

Data Breach Records51Social Media Account47Report / Summary40Employee List19Leaked Credential14Relationship Map13Paste Site Content12Physical Address12

Find subdomain from other data

Domain Name63IP Address12Company Name10DNS Records6WHOIS Data5
All OSINT use cases & data types