DNS records and IPs
A, AAAA, CNAME, MX and NS context beside each host.
NextOne surface, shown from several angles.
Subscope is a focused recon tool: find the hostnames public records already expose, give them context, and move the result into the next step of your workflow.
Certificate transparency
Turn public certificate names into a de-duplicated hostname inventory with first-seen dates and wildcard flags.
Light scan · certificate transparencyDeep scan
Merge Cert Spotter and Wayback hostnames into the certificate list without probing the target.
Deep scan · three sourcesArchive paths
Group Wayback captures by folder, filter to one host, and open the original URL.
Paths tab · CDXTriage and exports
Search as text or regex, hide platform noise, sort, page and export CSV, JSON or TXT.
In-memory · no refetchAlso in the explorer
Smaller pieces that make the list usable after the scan finishes.
Regex and text searchFilter the list without another request.
Noise controlsHide common labels and bring them back when needed.
PaginationAdjustable page size over the full result set.
Two-tier cacheA browser cache plus a 24-hour server result cache.
Shareable stateDomain, sort, filter, tab and depth live in the URL.
Honest statusUpstream limits, timeouts and source errors are explicit.
Planned features
Each of these gets a full page when it ships. No dates, no invented coverage.
HTTP status and technology
Reachability, redirects and a server stack guess.
NextTakeover signals
Flag dangling CNAMEs and unclaimed service pages.
ExploringScheduled monitoring
Re-run a saved surface and diff newly seen hosts.
ExploringCustom wordlists
Add dictionary discovery without pretending it is passive.
ExploringAPI access
Run a scan and read the same records from a script.
BacklogReady to see a surface?
Twenty unique sites are free per IP per day. Repeating a site does not count again.
Certificate transparency · Cert Spotter · Wayback