Search

Find Subdomains from an IP address

IP AddressSubdomain

Have an IP address? These OSINT tools take an IP address as input and return subdomains. 9 tools in our catalogue make this exact pivot — compare them by pricing, platform, and what they output, then chain the results into the next step of your investigation.

9tools
All IP Address tools
SpiderFoot icon

SpiderFoot

Automated OSINT reconnaissance framework

FreeOSSWebCLI
IN+13
OUT+3
DMNS icon

DMNS

Domain reconnaissance and DNS lookup tool

FreemiumWeb
IN
OUT
DNSLytics icon

DNSLytics

Reverse-DNS and SSL pivoting platform

FreemiumWebAPI
IN
OUT
Driftnet icon

Driftnet

Internet-scan intelligence for domains and IPs

FreemiumWebAPI
IN
OUT+2
Netlas.io icon

Netlas.io

Internet scan search engine for hosts, DNS, certs and WHOIS

FreemiumWebAPI
IN
OUT+3
RapidDNS icon

RapidDNS

DNS records, subdomains, and reverse-IP lookup

FreeWeb
IN
OUT
Sn1per icon

Sn1per

Automated recon and pentest framework

FreemiumOSSCLI
IN
OUT
Synapsint icon

Synapsint

All-in-one OSINT aggregator for domains, IPs, and emails

FreemiumWeb
IN+1
OUT+1
sn0int icon

sn0int

Modular semi-automatic OSINT framework with a sandboxed module registry

FreeOSSCLI
IN+1
OUT+2

From ip address, also find…

IOC (Indicator of Compromise)101Report / Summary71DNS Records37Banner / Service Info31CVE / Vulnerability31Threat Actor Profile30Geolocation (IP-based)26Open Ports25

Find subdomain from other data

Domain Name57Company Name9DNS Records6Email Address5WHOIS Data5
All OSINT use cases & data types