Sublist3r Subdomain Finder & Takeover Scanner

Real Subdomain Finder

onescales/real-subdomain-finder

Discover every subdomain for any domain. Queries 40+ OSINT sources including cert transparency, DNS archives & web scanners. Results enriched with DNS validation, HTTP probing, and subdomain takeover detection. Simple Subdomain Lookup that works!

Email & Subdomain Finder - theHarvester OSINT | 54 Sources

anshumanatrey/theharvester-osint

Cloud-hosted theHarvester OSINT tool. Harvest emails, subdomains, IPs, URLs and ASNs from 54+ public sources (Shodan, Censys, crt.sh, VirusTotal, SecurityTrails, GitHub, hunter.io). Full CLI feature parity — DNS brute force, subdomain takeover, screenshots. $0.003 per record harvested.

Subdomain Intelligence OSINT Scanner & Monitor

thescrapelab/subdomain-intelligence-osint

Subdomain finder and OSINT exposure monitor for authorized domains. Discover subdomains, validate DNS, classify live/auth-gated/DNS-only assets, detect technologies and providers, monitor changes, and generate reports.

Subdomains Finder API - Realtime DNS Subdomain Scanner

dev00/subdomains-finder-api-realtime-dns-subdomain-scanner

High-performance subdomain scanner that retrieves all registered subdomains, IP addresses, and Cloudflare protection status for any given domain.

Search a username across 3000+ websites and discover all associated social media, forums, and online accounts using Maigret (MIT). 5.0★ rated by users. Built for security researchers, journalists, and authorized investigations. JSON output ready for downstream pipelines.

Discover which 120+ sites an email address is registered on (LinkedIn, Twitter, Spotify, Pinterest, Imgur, and more) using the open-source holehe tool. No password-reset emails sent to target. For authorized OSINT and security research.

Audit TLS versions and negotiated cipher suites for a list of domains to ensure compliance and robust web security.

Discover subdomains of any domain fast using the open-source Subfinder engine — passive enumeration from dozens of public sources (certificate transparency, DNS datasets, search engines). For attack-surface mapping and authorized security research.

Subdomain Discovery API

crawland/subdomain-discovery-api

Paginated subdomain enumeration for any registered domain — DNS records, registrar, WHOIS, vendor reputation, and category labels per subdomain, served from the Crawland threat-intelligence backend.

Social Media Finder - Social Analyzer | Username 900+ Sites

anshumanatrey/social-analyzer

Cloud-hosted social-analyzer by qeeqbox. Find a username across 900+ social media and online platforms — confidence scored, country/category tagged, metadata extracted. One dataset record per detected profile. $0.005 per record.