Passive only
Public data sources only: no brute forcing, no scanning.
Subdomain Scanner Find subdomains without touching the target.
Try it now
Output
Passive enumeration from certificate transparency logs and passive DNS. Nothing is sent to the domain you investigate.
curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant50 free requests/month · instant API key · no signup form
Capabilities
Key features at a glance.
Certificate transparency
Hostnames listed in issued TLS certificates.
Passive DNS
Hostnames observed in DNS resolutions over time.
Applications
Use cases to evaluate first.
Attack surface
Find forgotten subdomains that may still be exposed.
Security assessment
Scope a penetration test.
Brand monitoring
Spot unauthorized subdomains on your domain.
Threat hunting
Map the infrastructure around a suspicious domain.
FAQ
Frequently asked questions.
How do you discover subdomains?
From certificate transparency logs and passive DNS records. Nothing is sent to the domain itself.
Is subdomain scanning legal?
Passive enumeration only reads public data sources. We do not scan or brute-force the target.
How many subdomains can you find?
It depends on how many certificates and DNS observations exist for the domain. Large organizations often have hundreds.
Explore
Related tools and pages.
Test it with your own indicators.
The free plan includes 50 lookups a month. Check the sources and limits, then connect the API.
No credit card required · Free API key