SecurityTrailssecuritytrails.com
Historical DNS records, subdomains, associated domains and reverse lookups by IP, nameserver or mail server, from a very large passive DNS dataset.
domainip / asndetails
tools / completedns
CompleteDNS History
Nameserver change history for domains going back to the early 2000s. Useful for dating ownership and hosting changes.
freemiumacct optionalweb
used in playbooks
similar tools
assetfindergithub.com
Minimal Go tool that finds domains and subdomains related to a given domain from CT logs, passive DNS and other public sources.
domaindetails
BBOTgithub.com
Recursive internet scanner that chains 100+ modules for subdomain enumeration, web spidering and email harvesting. Has a passive-only preset.
domainip / asncompanydetails
BuiltWithbuiltwith.com
Technology profiler for websites that shows the CMS, analytics, ad networks and hosting, plus a relationship tool linking sites by shared tracking IDs.
domaindetails
C99 Subdomain Findersubdomainfinder.c99.nl
Free web-based subdomain finder that returns subdomains with their resolved IPs and Cloudflare status. Previous scans are browsable.
domaindetails
Censyssearch.censys.io
Internet-wide scan data on hosts, services and certificates, with a powerful query language. Strong for certificate pivoting and finding related infrastructure.
ip / asndomaincompanydetails