BBOTgithub.com
Recursive internet scanner that chains 100+ modules for subdomain enumeration, web spidering and email harvesting. Has a passive-only preset.
domainip / asncompanydetails
tools / assetfinder
assetfinder
Minimal Go tool that finds domains and subdomains related to a given domain from CT logs, passive DNS and other public sources.
freeosscli
similar tools
subfindergithub.com
Fast passive subdomain enumeration CLI that aggregates dozens of sources (CT logs, passive DNS, search engines) without touching the target.
domaindetails
theHarvestergithub.com
Collects emails, subdomains, hosts, employee names and IPs for a domain from search engines, PGP servers, certificate logs and APIs.
domaincompanydetails
C99 Subdomain Findersubdomainfinder.c99.nl
Free web-based subdomain finder that returns subdomains with their resolved IPs and Cloudflare status. Previous scans are browsable.
domaindetails
crt.shcrt.sh
Certificate Transparency log search. Find every TLS certificate issued for a domain, which reveals subdomains, internal hostnames and related organizations.
domaincompanydetails
DNSDumpsterdnsdumpster.com
Free domain research tool from HackerTarget that maps DNS records, subdomains, hosts and mail servers from passive sources and draws a network graph.
domaindetails