Subdomain Finder & Recon Tool

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Discover subdomains of any domain fast using the open-source Subfinder engine — passive enumeration from dozens of public sources (certificate transparency, DNS datasets, search engines). For attack-surface mapping and authorized security research.

Subdomain Radar — Passive OSINT Enumeration

saregaa/subdomain-scraper

Discover subdomains silently. No brute-force — pure OSINT from 5 passive sources with DNS resolve, HTTP probing & takeover detection.

Map the public attack surface of any domain: discover subdomains, hosts, IP addresses and emails from free public OSINT sources (crt.sh, Certspotter, HackerTarget, DuckDuckGo). Powered by theHarvester. No setup, no API keys — for recon, bug-bounty and due diligence.

Subdomain Finder — Certificate Transparency (crt.sh)

bgfc97/crtsh-subdomain-finder

Discover subdomains of any domain from public Certificate Transparency logs (crt.sh). Attack-surface mapping and recon with first/last-seen dates. No key, no proxy.

Certificate Transparency & Subdomain Discovery Scraper

scrapers_lat/certificate-transparency-scraper

Discover subdomains and SSL/TLS certificates for any domain from public certificate transparency logs. Extract SAN hostnames, issuer, validity dates, wildcard and expiry flags. Perfect for attack-surface mapping, OSINT and asset inventory. Export to JSON, CSV or Excel.

Subdomain Intelligence OSINT Scanner & Monitor

thescrapelab/subdomain-intelligence-osint

Subdomain finder and OSINT exposure monitor for authorized domains. Discover subdomains, validate DNS, classify live/auth-gated/DNS-only assets, detect technologies and providers, monitor changes, and generate reports.

Subdomain Enumeration via Certificate Transparency

perryay/subdomain-enumeration-ct-logs

Discover subdomains from Certificate Transparency logs using crt.sh and CertSpotter. Supports multi-source aggregation, deduplication, diff reporting, continuous monitoring, wildcard detection, and batch scanning — ideal for penetration testing, attack surface mapping, and security monitoring.

Domain Intelligence Scraper

romy/domain-intelligence-scraper

Domain Intelligence Scraper performs comprehensive passive OSINT on any domain — combining 8 free data sources into one output record: WHOIS, RDAP, DNS records, subdomains (from 3 independent sources), open ports + CVEs, passive DNS history, IP geolocation, and HTTP security headers

Real Subdomain Finder

onescales/real-subdomain-finder

Discover every subdomain for any domain. Queries 40+ OSINT sources including cert transparency, DNS archives & web scanners. Results enriched with DNS validation, HTTP probing, and subdomain takeover detection. Simple Subdomain Lookup that works!