DNS records and IPs
A, AAAA, CNAME, MX and NS context beside each host.
NextFind every subdomain the internet already knows.
Certificate transparency, Cert Spotter and the Wayback Machine. One merged list. Nothing touches the target.
20 free scans left todayPassive only
Where the names come from.
Three public sources, one de-duplicated list. The scan service reads public records, and nothing touches the target.
Certificate transparencyPublic certificate logs
Cert SpotterA second certificate view
WaybackArchived hostnames and paths
One pass over the surface.
Discovery, context and export in one view. Filtering never spends another request.
Every SAN a certificate has published.
Read public certificate-transparency logs. Keep first-seen dates and wildcard flags.
www.example.com2018api.example.com2019app.example.com2020status.example.com2021
Light scanNot a single-log lookup.
Merge Cert Spotter and archive hosts, then de-duplicate by hostname.
Certificate transparency Cert Spotter Wayback+ 41 hosts
Three sourcesThe old surface is still evidence.
Group Wayback captures by folder.
/careers4 captures/docs7 captures/login10 captures
CDX pathsMove the list into your workflow.
Filter in memory, then export CSV, JSON or TXT.
hosts.csv hosts.json hosts.txt
No refetchFrom a domain to a usable map.
Three steps. No setup and no command line.
- 01
Enter a domain
Any URL is normalised to its apex before a request is made.
- 02
Choose a source set
Light reads certificate-transparency logs. Deep adds Cert Spotter and Wayback.
- 03
Triage and export
Filter, preview and download without spending another request.
api
staging
vpn.internal
docs
admin
status
Deep scan is a merge.
Light reads one certificate source. Deep adds Cert Spotter and Wayback hostnames, then merges everything by hostname.
What changesLightDeep
Certificate transparency
Cert Spotter merge-
Archive hostnames-
Wildcard records
CT requests11
Extra source calls-2
The list, ready to use.
Hostname, first seen, depth and source. Sort it, filter it, or export it.
| Hostname | First seen | Depth | Source | Open |
|---|---|---|---|---|
| api.example.com | Mar 2018 | 1 | CT logs | |
| staging.example.com | Jun 2021 | 1 | deep merge | |
| vpn.internal.example.com | Nov 2019 | 2 | Wayback | |
| docs.example.com | Jan 2023 | 1 | CT logs | |
| admin.example.com | Aug 2017 | 1 | Cert Spotter | |
| status.example.com | Feb 2020 | 1 | CT logs |
Illustrative data. Every live result carries its real source and timestamp.
Built for the first pass.
For people who need the surface, not another dashboard.
What comes next.
Each item gets a full page when it ships.
HTTP status and tech
Reachability, redirects and server stack.
NextTakeover signals
Flag dangling CNAMEs with the evidence attached.
ExploringScheduled monitoring
Re-run a saved surface and diff new hosts.
ExploringIs this an active scanner?
No. It reads public records and never connects to the target.
What do light and deep mean?
Light reads certificate-transparency logs. Deep adds Cert Spotter and Wayback, then merges everything.
Where do the names come from?
Certificate transparency, Cert Spotter and the Internet Archive. Every record keeps its source.
How many searches are free?
Twenty unique sites per IP per day. Repeating one of those sites does not count again.
Are my searches stored?
The app keeps a 24-hour result cache and the list of sites counted toward the free daily limit. No account is created.
Can I use the results commercially?
The data is public. Authorization to test a target is separate.
Start with a domain. Leave with a map.
Twenty free scans a day. Passive from the first request.
Twenty free scans per IP per day · Light and deep modes · CSV, JSON and TXT exports