Finds a domain's subdomains and DNS records, or an IP's reverse DNS, network and hosted domains, via HackerTarget
Run
Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).
{"tool":"osintverse-community/hackertarget"}Or just say: "Run osintverse-community/hackertarget on … with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.
ot run osintverse-community/hackertarget --format tableot install osintverse-community/hackertargetDocker image in a read-only container · talks to api.hackertarget.com · no key · up to 2 min. The first ot run installs the tool after asking once. Drop --format table for JSON.
ot? Install it in one linecurl -fsSL https://get.otinstaller.com/ot | shot release for your machine from GitHub Releases.checksums.txt, and the Ed25519 signature on that file against the key built into the script.ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.irm https://get.otinstaller.com/ot.ps1 | iexot release for your machine from GitHub Releases.checksums.txt, and the Ed25519 signature on that file against the key built into the script.ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.sha256:e7ad1c83…ab34cd. The same bytes on every install; ot pulls by digest, never by tag.ot checks the same identity before every install and refuses another signer.ot pulls the same digest from the mirror and checks the same signature.Not health-checked yet; 0.1.0 came out today; nobody has said yet whether it works.
0.1.0 is in its first week. Nobody has said whether it works yet.
Used 0.1.0?It's broken for me
{
"envelope": 1,
"tool": "osintverse-community/hackertarget@0.1.0",
"runtime": "docker",
"input": {
"domain": "otinstaller.com"
},
"started_at": "2026-10-24T19:28:13Z",
"exit_code": 0,
"entities": [
{
"type": "subdomain",
"value": "api.otinstaller.com",
"source": "hackertarget",
"confidence": "medium",
"attrs": {
"domain": "otinstaller.com",
"ips": [
"104.21.85.36"
]
}
},
{
"type": "subdomain",
"value": "get.otinstaller.com",
"source": "hackertarget",
"confidence": "medium",
"attrs": {
"domain": "otinstaller.com",
"ips": [
"104.21.85.36"
]
}
},
{
"type": "subdomain",
"value": "mirror.otinstaller.com",
"source": "hackertarget",
"confidence": "medium",
"attrs": {
"domain": "otinstaller.com",
"ips": [
"172.67.201.227"
]
}
},
{
"type": "subdomain",
"value": "www.otinstaller.com",
"source": "hackertarget",
"confidence": "medium",
"attrs": {
"domain": "otinstaller.com",
"ips": [
"172.67.201.227"
]
}
},
{
"type": "dns_record",
"value": "A 104.21.85.36",
"source": "hackertarget",
"confidence": "high",
"attrs": {
"domain": "otinstaller.com",
"record_type": "A",
"ip": "104.21.85.36"
}
}
… 20 more
],
"warnings": []
}Recorded from the registry's own run of version 0.1.0 on its test input, 24 Oct 2026. --format table to read it; ot extract and ot auto to continue.
Looks a domain or an IP address up in HackerTarget's free API. For a domain it lists the subdomains HackerTarget's host search knows, with the addresses they had, and the domain's DNS records (A, AAAA, MX, NS, TXT, SOA). For an IP address it gives the reverse DNS name, the network (ASN) that announces it and its owner, and the domains hosted on it. Only HackerTarget's passive lookups are used, never its port scans or other tools that send traffic to the target: nothing reaches the target but ordinary DNS queries from HackerTarget's servers.
ot run osintverse-community/hackertarget --domain example.com
ot run osintverse-community/hackertarget --ip 8.8.8.8Give exactly one.
| Input | Required | |
|---|---|---|
domain |
one of these | Subdomains and DNS records of this domain |
ip |
one of these | Reverse DNS, network and hosted domains of this address |
None needed. Without a key HackerTarget allows 50 API calls a day from one address, and only about 20 for the host search, reverse IP and reverse DNS lookups; each run makes two calls for a domain or three for an IP address. HACKERTARGET_API_KEY (ot keys set HACKERTARGET_API_KEY), from a paid membership, lifts the limit: https://hackertarget.com/pricing/. When the day's calls are used up the tool exits with code 1 and says so.
Free lookups return at most 500 lines, so a large domain's subdomain list or a busy address's hosted domains are cut short. The subdomains come from HackerTarget's own DNS data, which may include names that no longer resolve. Domains hosted on an address are reported with low confidence when there are more than 20 of them, since that usually means shared hosting or a CDN. A domain HackerTarget doesn't know makes it answer "error invalid host", which exits with code 1.
Find more subdomains in Certificate Transparency logs with osintverse-community/crtsh-subdomains, or see what runs on an address with osintverse-community/shodan-internetdb.
python -m unittest
ot validateReleases are built, signed and published by the otinstaller release workflow (Actions tab, with the version to release).
MIT
hackertarget finds subdomain, dns record, ip, domain, organization. Tools that take those:
subdomain → 10 toolsdns record → 10 toolsip → 10 toolsdomain → 10 toolsorganization → 6 toolsot auto, with a saved result
Alternatives to hackertarget that also take a domain; ot auto runs every installed one on the same value.
Checks a domain's SPF, DMARC, MX, BIMI and DNSSEC records and reports problems
Reads a server's TLS certificate: names it covers, issuer, validity, fingerprints and JARM
Looks up a domain's A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records
Finds registered look-alike domains for phishing, typosquatting and brand impersonation
Enumerates a domain's DNS: standard records, SRV services, zone transfer checks and DNSSEC