Enter an apex domain. In one call we pull passive Certificate Transparency logs (crt.sh), run an active DNS brute-force against a curated top-200 wordlist, dedupe across sources, and enrich every hit with a live DNS resolve, HTTP HEAD, and TLS certificate peek. Dangling CNAMEs to abandoned S3, Heroku, Vercel, GitHub Pages, Azure Blob, Cloudfront and other cloud fingerprints are flagged as takeover-risk. No signup for ad-hoc scans, no rate limit, same backend as our API and MCP servers.
Certificate Transparency alone misses long-tail hosts that never issued a public cert. DNS brute-force alone misses hosts on non-standard prefixes. This tool combines both, verifies liveness per host, and cross-checks each CNAME against the same takeover-risk fingerprints security researchers use — so the list you get is the list you can act on.
Passive CT logs catch every host that ever issued a publicly-trusted cert (Let's Encrypt, DigiCert, Sectigo, Google Trust). Active DNS brute-force catches every host on a common infra prefix (api, staging, admin, mail, mx1, ns2). Same wallclock budget, no data left on the table.
Every hit is resolved (A record + CNAME), HEAD'd over HTTPS with HTTP fallback, and TLS-peeked for issuer + expiry — all in parallel, all bounded by a hard 3-second timeout. Dead hosts sort last; live hosts show status, cert, and IPs inline.
Every CNAME is checked against Amazon S3 / CloudFront, Heroku, Azure Blob + Websites, GitHub Pages, Cloudflare Pages, Netlify, Vercel, ReadTheDocs, Zendesk, HelpScout, Tumblr and more. Dangling targets (CNAME resolves nowhere) get flagged critical — the exact pattern Detectify and Project Discovery use.
Every host row shows which source(s) surfaced it and the earliest date we've seen it — the CT log's `min_entry_timestamp` when available. Useful for spotting freshly-provisioned staging tiers and old zombie hosts.
Passive CT output is workspace-agnostic — it's a property of the apex, not the tenant. We cache it in a shared CachedResult row for 6h so a second scan of the same apex from anywhere returns instantly and doesn't hammer crt.sh.
Every field is a JSON API call. The Prism AI agent (/chat) can enumerate a domain on request. MCP servers see the same data. Wire subdomain discovery into your SIEM, brand-monitoring cron, or bug-bounty workflow.
Two independent discovery pipelines run in parallel — each catches hosts the other misses. A third passive-DNS source (SecurityTrails / VirusTotal) is reserved for business-tier customers.
Discovery gives you a list of hostnames. Liveness enrichment tells you which ones are real, what they're serving, and whether the cert is healthy — all inside the same scan, bounded by hard timeouts so a single slow host doesn't stall the report.
Subdomain takeover is the single most common cloud-native attack that doesn't require a vulnerability — just abandoned infrastructure. A CNAME points at a cloud service you no longer own, and an attacker claims the target. Detectify's research shows takeover is used in real credential harvest, cookie theft, and CSP bypass every week.
Every field on this page is available as JSON. Useful for attack-surface audits, brand-monitoring cron jobs, bug-bounty automation, SOC playbooks, M&A due-diligence, and asset-inventory pipelines.
const res = await fetch(
'https://api.domainscan.in/v1/security/subdomains?domain=' +
encodeURIComponent('github.com') + '&sync=true'
);
const {data: report} = await res.json();
console.log(report.counts); // { total: 42, alive: 31, dead: 11 }
console.log(report.subdomains[0]); // { host, ips, cname, http, tls, alive, takeoverRisk, sources, firstSeen }
console.log(report.sources.ct.count); // 38
console.log(report.sources.brute.count); // 7
// Filter takeover-risk hosts for triage
const risky = report.subdomains.filter(s => s.takeoverRisk);
for (const r of risky) console.log(`⚠ ${r.host} → ${r.cname}`);
// Filter alive hosts with soon-to-expire certs
const soonExpiring = report.subdomains
.filter(s => s.alive && s.tls?.notAfter)
.filter(s => (new Date(s.tls.notAfter) - Date.now()) / 86400000 < 30);# Fast JSON response with default free-tier limits (25 hosts, CT + brute).
curl -s 'https://api.domainscan.in/v1/security/subdomains?domain=github.com&sync=true' | jq '.data.counts'
# Only takeover-risk hosts
curl -s 'https://api.domainscan.in/v1/security/subdomains?domain=github.com&sync=true' \
| jq '.data.subdomains[] | select(.takeoverRisk == true) | {host, cname}'
# Streaming SSE (progressive results as each host is enriched)
curl -N 'https://api.domainscan.in/v1/security/subdomains?domain=github.com&sync=false'{
"apex": "github.com",
"scannedAt": "2026-09-03T…",
"sources": {
"ct": { "count": 38, "ms": 2102 },
"brute": { "count": 7, "ms": 360, "checked": 200 },
"passive": { "count": 0, "skipped": true }
},
"counts": { "total": 42, "alive": 31, "dead": 11 },
"subdomains": [
{
"host": "api.github.com",
"sources": ["ct", "brute"],
"firstSeen": "2018-11-04T…",
"ips": ["140.82.121.5"],
"cname": null,
"http": { "scheme": "https", "status": 200, "server": "…" },
"tls": { "issuer": "DigiCert", "notAfter": "2026-11-30T…", "subjectCN": "*.github.com" },
"alive": true,
"takeoverRisk": false,
"lastSeenAlive": "2026-09-03T…"
}
],
"tier": "free",
"tierProfile": { "sources": ["ct", "brute"], "bruteLimit": 25, "limit": 25, "liveness": true },
"elapsedMs": 5843,
"cached": false
}