Subdomain Finder

Certificate Transparency + DNS labels + C99.nl published scans.

3.9 (35)

5624 views

DNS records TLS / SANs crt.sh subdomains C99.nl subdomain fallback

Public hosts only. Paths come from robots.txt and sitemap.xml (published folders), not a directory brute-forcer. Ports are a short common list with a short timeout. C99 uses published scan pages, and the official API if you set c99_api_key.