Use our subdomain finder tools to discover the subdomains of any target domain name. Map web infrastructure, identify overlooked assets, and uncover potential security exposure.
500 free API requests. No credit card required.
Enter a domain name.
That lookup could not be run. Please try again.
Too many lookups just now. Please try again shortly.
9.6 Billion+
Subdomains
15 Million+
Subdomains discovered daily
52,000+
Satisfied customers
15+
Years of data crawling
Choose a subdomain finder product that fits your workflow. Search in your browser, automate with an API, download the full dataset, or ask an AI assistant.
With one API call, get a list of all subdomains related to a given domain name, with first-seen and last-seen timestamps. Responses come in JSON or XML, so you can automate subdomain enumeration in your own scripts and security workflows.
Best for: security automation
500 free API requests. No credit card required.
Sample request
GET https://subdomains.whoisxmlapi.com/api/v1?apiKey=YOUR_API_KEY&domainName=example.com&outputFormat=JSONSample JSON response
{
"search": "example.com",
"result": {
"count": 4,
"records": [
{
"domain": "www.example.com",
"firstSeen": 1402358400,
"lastSeen": 1791331200
},
{
"domain": "mail.example.com",
"firstSeen": 1421625600,
"lastSeen": 1791244800
},
{
"domain": "api.example.com",
"firstSeen": 1536624000,
"lastSeen": 1791417600
},
{
"domain": "dev.example.com",
"firstSeen": 1553644800,
"lastSeen": 1790553600
}
]
}
}Enter a domain name and get a list of its subdomains, along with the dates each one was first and last seen. No code or setup needed.
Best for: quick checks and one-off investigations
Enter a domain name.
That lookup could not be run. Please try again.
Too many lookups just now. Please try again shortly.
Example: bbc.com
Download 9.6 billion+ subdomain records as CSV files and load them into your own systems and security solutions. Run offline analysis and asset discovery at scale without any rate limiting.
Best for: bulk analysis and in-house data enrichment
Sample file: subdomains-db-1k-sample.csv
subdomain,first_seen,last_seen
www.example.com,1402358400,1791331200
mail.example.com,1421625600,1791244800
api.example.com,1536624000,1791417600
dev.example.com,1553644800,1790553600
shop.example.org,1593993600,1789171200
vpn.example.net,1480464000,1791158400
support.example.io,1613260800,1790035200
...First rows of a sample file. The full download contains 9.6 billion+ records.
Chat in your browser
Ask Jake AI for the subdomains of any domain. It runs the lookup and can follow up with IPs and certificates in the same chat.
[Analyst] Find all subdomains of example.com
[Jake] 4 subdomains found
www · mail · api · dev .example.com
Best for: investigations without code
Free signup credits work with Jake AI.
Plug into your own AI tool
Connect ChatGPT, Claude, Cursor or another MCP client. It uses the same API key and credits as the Subdomains Lookup API.
https://mcp-hosted.whoisxmlapi.com/mcpBest for: AI agents and LLM workflows
The server is free. You pay only for credits used.
A subdomain finder, or subdomain discovery tool, helps identify subdomains associated with a root domain, such as api.example[.]com, shop.example[.]com, or support.example[.]com. Subdomains can point to different websites, applications, APIs, development environments, and other internet-facing services.
Organizations and security teams use subdomain discovery to better understand a domain's web infrastructure, identify assets that may have been forgotten or overlooked, and investigate infrastructure connected to domains of interest.
Access a database of more than 9.6 billion subdomain records collected over 15 years of data crawling. The database is updated daily, with more than 15 million subdomains discovered each day, helping you identify both previously observed and newly discovered subdomains.
Skip the time-consuming process of collecting, parsing, and combining raw subdomain data from multiple sources. WhoisXML API Subdomain Finder products provide structured subdomain records that you can use for asset discovery, security investigations, and automated workflows.
Our subdomain finder pulls results from data we've already collected, including passive DNS data, SSL/TLS certificates, and certificate transparency logs. That means you can find subdomains of any domain without active scanning or sending queries to the target's servers, so your research stays out of their logs.
Subdomain enumeration helps organizations find all subdomains of a domain, including forgotten or overlooked subdomains (e.g., shadow IT). This list is combined with other digital assets, allowing security professionals to map out attack surfaces for security assessments or bug bounty hunting.
Once you have a list of subdomains, you can start checking each subdomain for security issues, such as misconfigurations, outdated software, unpatched systems, and vulnerabilities. A forgotten or unmanaged subdomain can be a major entry point for attackers, and vulnerability scanners or penetration testers can uncover these weak spots.
Security researchers and bug bounty hunters use subdomain discovery to investigate suspicious infrastructure and identify potential security risks. For example, subdomains with dangling DNS records may be vulnerable to subdomain takeover, potentially allowing attackers to host unauthorized content under a legitimate domain.
Subdomain intelligence can also be used for managing the website infrastructure since a subdomains list can help developers visualize how different services (e.g., blog., api., support.) are hosted and interconnected.
A subdomain is a domain name that sits under another domain in the Domain Name System (DNS). Subdomains are commonly used to organize websites, applications, and services under a single registered domain.
For example, in blog.example[.]com, blog is the subdomain label, example[.]com is the registered domain, and .com is the top-level domain (TLD). One may say that blog.example[.]com is a subdomain of example[.]com.
Subdomains can point to different servers or services, but they do not necessarily host separate websites.
When you perform a subdomain lookup (whether with the API or the lookup tool), the tool lists all subdomains of a domain name that it was able to discover. While no subdomain lookup tool can guarantee 100% coverage, ours is known to be high due to the high quality of the data that powers subdomain discovery. It will also show the dates when they were first seen and last updated.
When you use the WhoisXML API's Subdomain Lookup tool, the request is sent to a massive, precompiled database that was built over the course of more than 10 years through continuous passive subdomain discovery techniques, such as DNS record analysis and browsing SSL certificates and certificate transparency logs.
This subdomains database is updated daily to ensure that the data remains as accurate and fresh as possible, especially given that the Subdomain Lookup is commonly used as a recon tool.
WhoisXML API's Subdomain Lookup stands out for its speed and accuracy. It returns a list of subdomains for any given root domain within a few seconds. In addition, the subdomain discovery tool uses a combination of techniques, including advanced algorithms and a regularly updated historical DNS records database, to provide a comprehensive list of subdomains. The subdomain data can be accessed through three different consumption models:
Yes, WhoisXML API provides highly accurate and regularly updated subdomain data, as it pulls information from multiple sources, including DNS records and certificate transparency logs.
Yes, you can automate subdomain lookups using the Subdomains Lookup API. The API responses are in JSON and XML formats, making the tool compatible with popular coding languages. Please check the API docs to see how to use the API in your workflows.
Yes, but you'll need a different tool. Our Subdomains Lookup API only accepts domain names as input to discover their subdomains. However, our Reverse IP API lets you search by IP address to identify associated domains and subdomains. Keep in mind that the results depend on available DNS data and may not include every hostname associated with the IP address.
“We want to provide all Cyberscape users the ability to integrate relevant data for their cyber threat investigations. WhoisXML API provides unique data that will be helpful to the cyber threat investigation community, allowing analysts to shorten the cycle of understanding and mitigating threats.”
“We did trials with WhoisXML API to make sure the data was truly resulting in successful takedowns. We were able to consistently discover and mitigate real threats as a result of using the products.”
Get the most relevant data to be ahead of emerging security threats.
The most accurate domain availability checker offered on the market.
Track domains registered in coordinated batches, complete with WHOIS and DNS details for every domain.
Check a domain's SSL certificate chain via API calls.
Discover subdomains related to the target domain name.
Find out the exact physical location of any IP address, email or domain name.
Keep track of the best business opportunities online.
Get data feeds of new registered domains along with their WHOIS data generated in real time.
Get data feeds of SSL certificates along with their well parsed fields in real time. Accurate. Up-to-date.
Get well-parsed and normalized WHOIS information for any domain name, IP address or email.
Find out which domains were added or dropped by registrants, with given search criteria.
Define website category of the given domain.
Assess the domain's or IP addresses reputation and risk profile with a simple score based on a comprehensive...
Identify who is hosting a particular domain name or website.
Ensure the validity and quality of any email address.
Give the list of domain names tied to the specified DNS records via API calls with outputs in JSON and XML.
We provide complete and relevant domain WHOIS data which can be customized and easily integrated as per your business needs.
Get insights for the new business registered on the web.
Monitor exact matches, variations and common misspellings of your brand name & trademarks.
Get the most comprehensive database of SSL (Secure Sockets Layer) Certificates.
Easily identify malicious resources and retrieve their threat information.
Find connections between various domains, individuals and organizations.
Find domains and subdomains related by specific terms in their hostnames.
Enhance your domain research toolkit by our enterprise-grade web-based solution that helps you in searching...
We are here to listen. For a quick response, please select your request type. By submitting a request, you agree to our Terms of Service and Privacy Policy.
