Search

Find Subdomains from an IP address

IP AddressSubdomain

Have an IP address? These OSINT tools take an IP address as input and return subdomains. 12 tools in our catalogue make this exact pivot — compare them by pricing, platform, and what they output, then chain the results into the next step of your investigation.

12tools
All IP Address tools
SecurityTrails icon

SecurityTrails

DNS history and domain intelligence platform

FreemiumWebAPI
IN
OUT+1
SpiderFoot icon

SpiderFoot

Automated OSINT reconnaissance framework

FreeOSSWebCLI
IN+13
OUT+3
DMNS icon

DMNS

Domain reconnaissance and DNS lookup tool

FreemiumWeb
IN
OUT
DNSLytics icon

DNSLytics

Reverse-DNS and SSL pivoting platform

FreemiumWebAPI
IN
OUT
Driftnet icon

Driftnet

Internet-scan intelligence for domains and IPs

FreemiumWebAPI
IN
OUT+2
HackerTarget icon

HackerTarget

Free recon tools (DNS, ports, headers, WHOIS)

FreemiumWebAPI
IN
OUT
Netlas.io icon

Netlas.io

Internet scan search engine for hosts, DNS, certs and WHOIS

FreemiumWebAPI
IN
OUT+3
RapidDNS icon

RapidDNS

DNS records, subdomains, and reverse-IP lookup

FreeWeb
IN
OUT
SecurityTrails Historical DNS icon

SecurityTrails Historical DNS

SecurityTrails deep DNS history

FreemiumWebAPI
IN
OUT
Sn1per icon

Sn1per

Automated recon and pentest framework

FreemiumOSSCLI
IN
OUT
Synapsint icon

Synapsint

All-in-one OSINT aggregator for domains, IPs, and emails

FreemiumWeb
IN+1
OUT+1
sn0int icon

sn0int

Modular semi-automatic OSINT framework with a sandboxed module registry

FreeOSSCLI
IN+1
OUT+2

From ip address, also find…

IOC (Indicator of Compromise)107Report / Summary75DNS Records42CVE / Vulnerability34Banner / Service Info33Threat Actor Profile31Geolocation (IP-based)30WHOIS Data30

Find subdomain from other data

Domain Name63Company Name10DNS Records6Email Address5WHOIS Data5
All OSINT use cases & data types