Pricing

from $2.50 / 1,000 results

Subdomain Takeover Auditor — Find Claimable DNS Records

Find dangling DNS records pointing at decommissioned third-party services — the kind anyone can claim to hijack a subdomain of your brand for phishing. Discovers subdomains passively from certificate transparency, resolves CNAMEs, and confirms matches against a public takeover-fingerprint database.

Pricing

from $2.50 / 1,000 results

Rating

0.0

(0)

Developer

alaudin burki

Actor stats

Bookmarked

Total users

Monthly active users

4 days ago

Last modified

Real Subdomain Finder

onescales/real-subdomain-finder

Discover every subdomain for any domain. Queries 40+ OSINT sources including cert transparency, DNS archives & web scanners. Results enriched with DNS validation, HTTP probing, and subdomain takeover detection. Simple Subdomain Lookup that works!

One Scales

113

5.0

Subdomain Finder (Certificate Transparency)

webdatatools/subdomain-finder

Subdomain Finder enumerates every subdomain of a domain from Certificate Transparency logs (crt.sh, Cert Spotter) and resolves each one — one row per subdomain, no proxies needed.

Murat Uzun

Subdomain Finder: Bulk Certificate Transparency Search

accountable_eel/subdomain-discovery-lookup

Find subdomains for a list of domains without an API key: bulk subdomain enumeration from the free public Certificate Transparency logs (certspotter), a crt.sh alternative. Every subdomain returned had a real TLS certificate issued for it, with its first-seen date. Send rows to Google Sheets.

Adrian Voss

HarvestHawk — URL Archive + Subdomain Takeover Scanner

inexhaustible_glass/url-harvester

Every known URL of a domain from 6 free archives (Wayback, Common Crawl, AlienVault OTX, URLScan, crt.sh, sitemap) merged and deduped — PLUS a live subdomain-takeover risk and public S3-bucket exposure check on every subdomain found. Block-proof, no API key, no login.

Hitman studio

Subdomain Takeover & Forgotten Asset Finder

magebase/subdomain-takeover-finder

Dangling CNAME records pointing to abandoned S3 buckets or Heroku apps leave corporate domains vulnerable to hostile takeovers.

magebase

Subdomain Finder - CT Log Enumeration + Live DNS Check

eliai/subdomain-finder

Enumerate a domain's subdomains from Certificate Transparency logs, with an optional live DNS resolve. All subdomains in one record. $0.005 per domain (not per subdomain), far cheaper than paid finders; failures are free.

Broke to Built

Subdomain Finder - Discover Every Subdomain Of A Domain

thirdwatch/subdomain-finder

Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.

Thirdwatch

Domain Intelligence — DNS, WHOIS, SSL & Subdomains

dalbian/domain-intelligence

Full public record for any domain: DNS records of every type, RDAP registration details, mail security posture (SPF, DMARC, DKIM), detected providers, and every subdomain and SSL certificate from the Certificate Transparency logs.

Benjamin Jerez

Subdomain Finder

mina_safwat/subdomain-finder

Finds every subdomain of a domain from public certificate transparency logs — thousands in under a second, without touching the target

Mina

Subdomain Discovery API

crawland/subdomain-discovery-api

Paginated subdomain enumeration for any registered domain — DNS records, registrar, WHOIS, vendor reputation, and category labels per subdomain, served from the Crawland threat-intelligence backend.