DNS brute force ACTIVE
A wordlist of about 50 likely names tested one by one. Finds the dev., the staging., the vpn. that never had a certificate.
Advanced Mode
The free mode is light on resources: it reads the public certificate record and already finds plenty. The advanced mode spends more time and more lookups to squeeze out the maximum results possible. Check out what it offers below.
IP ACTIVE
Every subdomain the brute force finds, with the IP it points to.
Provider and status COMING SOON
Which cloud each subdomain lives in, and whether it answers on the web right now.
Dangling CNAME ACTIVE
Subdomains pointing at services that no longer exist — the unlocked door nobody remembers leaving open.
No limits ACTIVE
As many queries as you want, no wait between them, forever.
Takeover detection COMING SOON
Dangling CNAME pointing at S3, GitHub Pages, Heroku and other providers known to allow hijacking. We tell you which ones are up for grabs.
History and diff COMING SOON
Every scan compared against the last one. A new subdomain since last time? We point it out.
Export CSV/JSON ACTIVE
The whole list, downloaded in one click, in whatever format your spreadsheet or script prefers.
Screenshot of each one COMING SOON
A screenshot of every subdomain that answers on the web — see what is running there without opening tab after tab.
$4.99
Per year · does not auto-renew
Subscribe
You confirm on the next screen, before anything is charged.