Subdomains

Enumerate the subdomains of a target through multiple sources, then check which of them are alive via DNS. Each source carries a provider label and cost badge so it is clear how the data was sourced.

STEP 1 — Enumerate

Pick the sources to run in parallel, then submit a target domain. Each source returns its own subdomain list; the results are merged with provenance preserved so you can see which tool found each name.

Sources

crt.shCertificate Transparencyfree
CertSpotterCertificate Transparency (SSLMate)free
Wayback MachineInternet Archive — historical URLsfree
HackerTargetaggregator (paid contract or unauth tier)free
Edgewatch CTCertificate Transparency (Edgewatch replica)free
WhoisXML SDWhoisXML Subdomains Discovery (DRS, 1 credit / call)DRS 1cr
VirusTotalaggregatorfree 500/day(API key required (free signup))
AlienVault OTXpassive DNS / threat intel aggregatorfree(API key required (free signup))
Project Discovery Chaospassive recon aggregatorfree(API key required (free signup))
Edgewatch CT (paid)Certificate Transparency (Edgewatch replica)paid(API key / auth token required)
pentest-tools.comaggregator subdomain finderpaid(API key required (paid plan))
ShodanInternet-wide scanner indexpaid(API key required (paid plan))
CensysInternet-wide scanner indexpaid(API key required (paid plan))
subfinder (GHA)Project Discovery CLI aggregator — 20+ passive sourcesfree
OneForAll (GHA)Subdomain enumeration CLI aggregatorfree(requires GHA Recon runner (v0.17))

STEP 2 — Liveness check

Resolve A / AAAA / CNAME / MX / NS for each subdomain via DoH (Cloudflare 1.1.1.1). The matrix shows three states per record type: green check = got at least one record, dash = upstream responded with none, red × = no response (timeout / 5xx). Click a green check to expand and see the actual records inline. NS is shown but treated as a delegation signal only, not a liveness one. A row is marked alive when any of A / AAAA / CNAME / MX returns a record.