theHarvester OSINT: Hosts, Subdomains & Email

Map the public attack surface of any domain: discover subdomains, hosts, IP addresses and emails from free public OSINT sources (crt.sh, Certspotter, HackerTarget, DuckDuckGo). Powered by theHarvester. No setup, no API keys — for recon, bug-bounty and due diligence.

Email & Subdomain Finder - theHarvester OSINT | 54 Sources

anshumanatrey/theharvester-osint

Cloud-hosted theHarvester OSINT tool. Harvest emails, subdomains, IPs, URLs and ASNs from 54+ public sources (Shodan, Censys, crt.sh, VirusTotal, SecurityTrails, GitHub, hunter.io). Full CLI feature parity — DNS brute force, subdomain takeover, screenshots. $0.003 per record harvested.

theHarvester Domain OSINT Collector

automation-lab/theharvester-domain-osint-collector

Collect source-attributed public certificate hostnames, resolved IPs, DNS aliases, and related URL candidates for recurring domain reconnaissance.

Domain Intelligence Scraper

romy/domain-intelligence-scraper

Domain Intelligence Scraper performs comprehensive passive OSINT on any domain — combining 8 free data sources into one output record: WHOIS, RDAP, DNS records, subdomains (from 3 independent sources), open ports + CVEs, passive DNS history, IP geolocation, and HTTP security headers

Subdomain Radar — Passive OSINT Enumeration

saregaa/subdomain-scraper

Discover subdomains silently. No brute-force — pure OSINT from 5 passive sources with DNS resolve, HTTP probing & takeover detection.

Subdomains Finder API - Realtime DNS Subdomain Scanner

dev00/subdomains-finder-api-realtime-dns-subdomain-scanner

High-performance subdomain scanner that retrieves all registered subdomains, IP addresses, and Cloudflare protection status for any given domain.

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

Digital footprint report for one target — username, email, domain or phone. Runs Maigret, Sherlock, holehe, theHarvester, WHOIS and dnstwist in one pass and correlates every hit into a risk-scored OSINT report. Those actors run on your account and bill separately — see README.

Subdomain Finder – Certificate Transparency

datascraperes/crt-name-subdomain-finder

Find unique subdomains for up to 10,000 domains from live Certificate Transparency records. Normalize URLs, remove wildcard and duplicate hostnames, export structured results, and automate passive asset discovery through the Apify API.

Email OSINT Account Search

khadinakbar/email-osint-search

Check email addresses for public account-registration signals across a pinned 121-service catalog. Returns one privacy-safe scan record per email with found sites, categories, uncertainty, source domains, and timestamps for authorized OSINT research.