app.subdomain/subdomains

Subdomain API

Find known subdomains of a domain. Passive data; may include historic entries. List or count.

1.0.1
Version
remote
Transport
2
Tools

Security review

Review passed

Reviewed 1h ago.

  • tools: 2 tools scanned
  • metadata: scanned

No findings.

Tools (2)

  • find_subdomains

    List known subdomains (hostnames) of a root domain. Data is passive (not active scanning): results are historic observations and may include subdomains that no longer resolve or are no longer live. Results are a point-in-time snapshot that changes over time as new subdomains are observed — re-query rather than caching the result. Use for attack-surface mapping, security recon, asset inventory, or SEO host discovery. Hostnames are returned most-recently-seen first. The response always reports `total` (full distinct count known) and a `truncated` flag, so you can tell when more exist beyond `limit`.

  • count_subdomains

    Return only the total number of distinct subdomains known for a domain — no list. Cheap and low-token. Use when the user asks "how many subdomains" or you only need the size of the attack surface. Count includes historic subdomains that may no longer be live. It is a point-in-time figure that changes over time, so treat it as current-as-of-query, not a fixed value.