osintverse-community/subfinder
Finds a domain's subdomains passively from dozens of public sources
Takes domain → finds subdomain
No key · Docker
No key · Docker
Verified publisher
Find a domain's subdomains
20 tools. 14 run with ot in a sandbox on Windows, macOS and Linux; 6 with otlite on Linux and macOS, no Docker. Compare them side by side ↓
Subdomains are where forgotten hosts, staging sites and third-party services sit. Passive tools collect them from certificate transparency logs, search engines and public datasets without sending the target any traffic; brute-force tools try a word list over DNS and find names no dataset has recorded. Start passive, merge the results, then resolve and probe only what you need.
With ot, in a sandbox
All domain tools →Windows, macOS and Linux, with Docker or Podman. Each tool runs in a read-only container that can reach only the sites it declares, and every result comes back in the same JSON shape.
osintverse-community/subdominator
Finds a domain's subdomains passively from about 70 public sources
Takes domain → finds subdomain
No key · Docker
No key · Docker
Verified publisher
osintverse-community/findomain
Finds a domain's subdomains passively from certificate logs and public APIs
Takes domain → finds subdomain
No key · Docker
No key · Docker
Verified publisher
osintverse-community/xsubfind3r
Finds a domain's subdomains passively from sources such as crt.sh, Certspotter, Wayback Machine and OTX
Takes domain → finds subdomain
No key · Docker
No key · Docker
Verified publisher
osintverse-community/crt-sh
Finds a domain's subdomains from four Certificate Transparency log sources at once
Takes domain → finds subdomain
No key · Docker
No key · Docker
Verified publisher
osintverse-community/crtsh-subdomains
Finds a domain's subdomains in Certificate Transparency logs through crt.sh or Cert Spotter
Takes domain → finds subdomain
No key · Docker
No key · Docker
Verified publisher
osintverse-community/anubis
Finds a domain's subdomains from certificate logs, HackerTarget, Netcraft and other sources, plus zone transfers
Takes domain → finds subdomain
No key · Python wheel
No key · Python wheel
Verified publisher
osintverse-community/theharvester
Gathers emails, subdomains, hosts and IPs for a domain from public search engines and datasets
Takes domain → finds email, ip, subdomain
No key · Docker
No key · Docker
Verified publisher
osintverse-community/hackertarget
Finds a domain's subdomains and DNS records, or an IP's reverse DNS, network and hosted domains, via HackerTarget
Takes domain, ip address → finds dns record, domain, ip, organization…
No key · Docker
No key · Docker
Verified publisher
osintverse-community/urlscan-search
Searches urlscan.io's existing scans of a domain, IP or URL: each page's title, server, IP, network and country
Takes domain, ip address, url → finds domain, ip, subdomain, url
No key · Docker
No key · Docker
Verified publisher
osintverse-community/knockpy
Finds a domain's subdomains from passive sources, then checks each one's DNS, HTTP status and TLS certificate
Takes domain → finds certificate, ip, subdomain, url
No key · Python wheel
No key · Python wheel
Verified publisher
osintverse-community/alterx
Generates likely subdomain permutations from a known subdomain using pattern templates
Takes domain → finds subdomain
No key · Docker
No key · Docker
Verified publisher
osintverse-community/puredns
Brute-forces a domain's subdomains over DNS with massdns and filters out wildcard and poisoned answers
Takes domain → finds subdomain
No key · Docker
No key · Docker
Verified publisher
osintverse-community/shuffledns
Brute-forces a domain's subdomains with massdns and a bundled 5,000-word list, filtering wildcard answers
Takes domain → finds subdomain
No key · Docker
No key · Docker
Verified publisher
ot install osintverse-community/subfinder osintverse-community/subdominator osintverse-community/findomain osintverse-community/xsubfind3r osintverse-community/crt-shInstalls the first 5 in one go; ot auto d:… then runs every installed tool that takes a domain and saves the results. No ot yet? Install it in one line.
Without Docker, with otlite
All otlite tools →Linux and macOS. otlite installs each one with pip or git into its own virtualenv, pinned to a version it has tested: otlite install sublist3r.
- Sublist3rFast subdomain enumeration tool using multiple search engines and certificate transparency logsTakes domain
- CtfrAbusing Certificate Transparency logs for getting HTTPS websites subdomainsTakes domain
- DnsgenDNSGen is a powerful and flexible DNS name permutation tool designed for security researchers and penetration…Takes domain
- FierceA DNS reconnaissance tool for locating non-contiguous IP spaceTakes domain, IP address
- BbotThe recursive internet scanner for hackersTakes domain, IP address
- FinalreconAll In One Web ReconTakes domain, IP address, URL
The 14 registry tools side by side
| osintverse-community/ | subdomain | None | Offline | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | subdomain | None | Contacts the target | No | Python | No reports yet | fewer than 10 |
| osintverse-community/ | subdomain | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | subdomain | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | subdomain | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | dns record, domain, ip, organization… | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | certificate, ip, subdomain, url | None | Contacts the target | No | Python | No reports yet | fewer than 10 |
| osintverse-community/ | subdomain | None | Contacts the target | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | subdomain | None | Contacts the target | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | subdomain | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | subdomain | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | email, ip, subdomain | None | Online, passive | Yes | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | domain, ip, subdomain, url | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | subdomain | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
Facts from each tool's manifest and what people report about whether it works. "Reaches" says whether a run stays offline, reads public sources, sends requests about the target, or may notify them.
How to find a domain's subdomains
- Run two or three passive finders (subfinder, subdominator, crt-sh) and merge what they return.
- Generate permutations of the names you found (alterx) and resolve them with a brute-force tool if your scope allows active DNS.
- Probe the live hosts (httpx on the URL page) and read each one's TLS certificate (tlsx) for more names.
Every registry tool here runs on your machine in a sandbox, and ot auto d:… runs all the installed ones on one value.
Before you run one
What is the difference between passive and brute-force subdomain enumeration?
Passive tools read what others already recorded: certificate transparency logs, search engines, DNS datasets and archives. Brute-force tools (puredns, shuffledns) send a DNS query for every word in a list, which finds unlisted names but sends traffic to the domain's name servers. The "Reaches" column in the table says which a tool does.
Which subdomain finder finds the most?
No single source sees everything, so the usual answer is to run several and merge them. subfinder and subdominator each query dozens of passive sources, crt-sh reads four certificate log sources at once, and theharvester adds search engines. Each tool's page lists what it asks.
Do these tools send my search anywhere?
No. ot runs each tool on your own machine in a read-only container that can only reach the sites the tool declares, and results stay in your results folder. The registry only counts installs.
Do I need an API key?
Most tools here work without one; the row says "Key required" when one is needed, and ot keys set stores it in your OS keychain so only that tool's container sees it.
More from a domain
Every known URLLook-alike domainsWHOIS recordDNS recordsEmail addressesAll domain tools