Subdomain & DNS database

Hostnames we've observed for a domain and the IPs they map to — mined from TLS certificate SANs on the services we scan (plus CT logs & reverse DNS). Useful for surfacing cloud-hosted or vhost-gated services that a bare-IP scan misses.

Anonymous results are capped; sign in with a paid API key (X-API-Key) or use the API for the full list & export.