Subdomain Finder — Passive Enumeration & Discovery (Subfinder)

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

Subdomain Radar — Passive OSINT Enumeration

saregaa/subdomain-scraper

Discover subdomains silently. No brute-force — pure OSINT from 5 passive sources with DNS resolve, HTTP probing & takeover detection.

Subdomain Enumeration via Certificate Transparency

perryay/subdomain-enumeration-ct-logs

Discover subdomains from Certificate Transparency logs using crt.sh and CertSpotter. Supports multi-source aggregation, deduplication, diff reporting, continuous monitoring, wildcard detection, and batch scanning — ideal for penetration testing, attack surface mapping, and security monitoring.

Certificate Transparency Scraper: Subdomain Discovery

arman-bd/certificate-transparency-scraper

Query certificate transparency logs via crt.sh to enumerate subdomains, issuers, validity windows and certificate history for any domain. Passive attack-surface discovery. no login, no proxy, no browser.

Domain Intelligence Scraper

romy/domain-intelligence-scraper

Domain Intelligence Scraper performs comprehensive passive OSINT on any domain — combining 8 free data sources into one output record: WHOIS, RDAP, DNS records, subdomains (from 3 independent sources), open ports + CVEs, passive DNS history, IP geolocation, and HTTP security headers

Subdomain Finder - CT Log Enumeration + Live DNS Check

eliai/subdomain-finder

Enumerate a domain's subdomains from Certificate Transparency logs, with an optional live DNS resolve. All subdomains in one record. $0.005 per domain (not per subdomain), far cheaper than paid finders; failures are free.

Subdomain Finder – Certificate Transparency

datascraperes/crt-name-subdomain-finder

Find unique subdomains for up to 10,000 domains from live Certificate Transparency records. Normalize URLs, remove wildcard and duplicate hostnames, export structured results, and automate passive asset discovery through the Apify API.

Subdomain Finder — Certificate Transparency (crt.sh)

bgfc97/crtsh-subdomain-finder

Discover subdomains of any domain from public Certificate Transparency logs (crt.sh). Attack-surface mapping and recon with first/last-seen dates. No key, no proxy.

Certificate Transparency & Subdomain Discovery Scraper

scrapers_lat/certificate-transparency-scraper

Discover subdomains and SSL/TLS certificates for any domain from public certificate transparency logs. Extract SAN hostnames, issuer, validity dates, wildcard and expiry flags. Perfect for attack-surface mapping, OSINT and asset inventory. Export to JSON, CSV or Excel.