Skip to content
AssetDiscovery
Sign up

6.5B+ subdomains · updated continuously

Every known subdomain of a domain, from one API call.

Query a dataset of 6.5B+ unique subdomains with a single key. Get JSON with timestamps, a compact list or plain text back.

curl https://api.assetdiscovery.io/api/domain/example.com \
  -H 'Api-Key: YOUR_API_KEY'

200 OK · application/json

{
  "domain": "example.com",
  "total": 4521,
  "subdomains": [
    "api.example.com",
    "auth.example.com",
    "cdn.example.com",
    "dev.api.example.com",
    "mail.example.com",
    …
  ]
}

Dataset

The data behind every query

Unique subdomains
6.5B+
Deduplicated hostnames, each with first and last seen dates
Root domains
722M+
Apex names seen across gTLDs and ccTLDs, each queryable for its subdomains
Top domains by subdomainsThe domains with the most known hostnames in the index.See the ranking

Built for bug bounty recon, attack surface monitoring and asset inventories.

The dataset

How the subdomain data is built

Hostnames stream in from several independent sources, are deduplicated per domain and served through the API with the dates each was first and last seen.

    • Certificate transparencyHostnames from public CT logs, often before they are linked anywhere
    • Website contentHostnames referenced in links and page source across crawled sites
    • Open source feedsPublic datasets and measurement feeds added to the index
    • Passive DNSHostnames observed in historical DNS resolution data
    • Active discoveryOur own scanners resolving and probing hostnames, running continuously

    Sources

  2. Process data

  3. GET /api/domain/example.com200

    Example output: a list of hostnames under the queried domain.

    Available via API

Use cases

Built for the teams who map the internet

Security teams, researchers and analysts use subdomain data to see what is exposed before attackers do.

  • Attack surface management

    Build a complete inventory of internet-facing hosts and feed it to your ASM platform. Diff first_seen to catch new assets the week they appear.

    ASM · CMDB · asset inventory

  • Bug bounty recon

    Start every program with the full subdomain list instead of waiting on brute force. Pipe the plain-text format straight into your toolchain.

    httpx · dnsx · nuclei

  • Subdomain takeover checks

    Find forgotten hosts that still point to deprovisioned cloud services, dangling CNAMEs and old staging environments before someone else does.

    CNAME audits · cloud hygiene

  • Pentest and red team scoping

    Show clients what is actually exposed under their domains, including hosts their own inventory missed, before the engagement begins.

    Scoping · external assessments

  • Vendor risk and M&A due diligence

    Size the external footprint of a supplier or acquisition target in one call, and track it after the deal closes.

    Third-party risk · TPRM

  • Threat intelligence enrichment

    Enrich indicators with every sibling host under the same domain, with first and last seen dates to place activity in time.

    SOC · SIEM · TIP enrichment

Getting started

From sign-up to first response

  1. Step 1

    Create a free account

    Sign up with email, GitHub or Google. Verify your email to activate the key.

    emailyou@company.comverified
  2. Step 2

    Copy your API key

    Your key is shown once at creation. Store it in your secret manager or shell profile.

    Api-Keyad_live_••••••••••••3f9c
  3. Step 3

    Query any domain

    Send GET /api/domain/{domain} with the Api-Key header and read the subdomains back.

    $ curl -H "Api-Key: $KEY" \…/api/domain/example.com200 OK · application/json

Formats

Choose the response shape that fits your pipeline

GET/api/domain/example.com200 · application/json
{"domain": "example.com","total": 4521,"subdomains": ["api.example.com","auth.example.com","cdn.example.com",…]}

Pricing

Start free, upgrade when you need every result

Monthly plans. Cancel any time.

Compare plans in detail

FAQ

Frequently asked questions

Something else? Email support@assetdiscovery.io