Subdomain Enumeration API — live hosts with IPs, free tier.
Subdomains from certificate transparency logs, passive DNS (25+ sources) and DNS brute-force. Every name is resolved again, so live hosts and their IPs come back apart from historical names.
// Run a lookup to see the JSON response
Long arrays are shortened here. The API returns them in full.
curl "https://domain-intelligence-api.p.rapidapi.com/domain/example.com/subdomains" \
-H "X-RapidAPI-Host: domain-intelligence-api.p.rapidapi.com" \
-H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY"
import requests
domain = "example.com"
r = requests.get(
f"https://domain-intelligence-api.p.rapidapi.com/domain/{domain}/subdomains",
headers={
"X-RapidAPI-Host": "domain-intelligence-api.p.rapidapi.com",
"X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
},
params={"wait": 1}, # wait for every source (up to ~25s)
timeout=40,
)
data = r.json()
print(data.get("live_count"), "live of", data["count"], "discovered")
for h in data.get("live", [])[:10]:
print(h["host"], h["ip"])
// Node 18+ (built-in fetch)
const res = await fetch(
"https://domain-intelligence-api.p.rapidapi.com/domain/example.com/subdomains",
{ headers: {
"X-RapidAPI-Host": "domain-intelligence-api.p.rapidapi.com",
"X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
} }
);
console.log(await res.json());
<?php
$ch = curl_init("https://domain-intelligence-api.p.rapidapi.com/domain/example.com/subdomains");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
"X-RapidAPI-Host: domain-intelligence-api.p.rapidapi.com",
"X-RapidAPI-Key: YOUR_RAPIDAPI_KEY",
]);
$data = json_decode(curl_exec($ch), true);
print_r($data);
What you get
Live vs historical
live lists hosts that resolve now, with their IP or CNAME target. Names that no longer resolve stay in subdomains.
Many sources
crt.sh and certspotter (CT logs), hackertarget, rapiddns and VirusTotal (passive DNS), subfinder in the background (25+ sources) and brute-force with about 770 names.
Less noise
Wildcard DNS is detected, huge shared-infrastructure subtrees collapse into pools, and DKIM records and invalid names are filtered out.
Fast or complete
About 3 seconds by default, with slow sources filling in the cache. ?wait=1 waits for every source, up to about 25 seconds.
Response fields
GET/domain/{domain}/subdomains returns one JSON object. The same object is the subdomains key of /lookup/{domain}.
| Field | Type | Meaning |
|---|---|---|
| count | integer | Total names discovered |
| live_count | integer | Names that resolve now |
| live | {host, ip}[] | Live hosts with IP or CNAME target |
| subdomains | string[] | All names, live first (up to 2,000) |
| returned | integer | Names in this response |
| sources_used | string[] | Per source: N found, enriching, rate-limited, unavailable or skipped |
| pools | {zone, count}[] | Collapsed shared-infrastructure subtrees |
Example response for stripe.com (arrays shortened)
{
"count": 458,
"live_count": 264,
"returned": 458,
"subdomains": [
"58.email.stripe.com",
"59.email.stripe.com",
"access.stripe.com",
"acp.stripe.com"
],
"live": [
{
"host": "58.email.stripe.com",
"ip": "13.224.202.101"
},
{
"host": "59.email.stripe.com",
"ip": "13.35.107.110"
},
{
"host": "access.stripe.com",
"ip": "198.137.150.41"
}
],
"sources_used": [
"crt.sh: unavailable",
"dns-brute: 28 found",
"hackertarget: rate-limited",
"rapiddns: 44 found",
"certspotter: 63 found",
"virustotal: 240 found",
"subfinder: 218 found"
],
"pools": []
}
What people build with it
Attack surface management
List every live host across your domains and catch forgotten dev or staging services.
Bug bounty and pentest recon
Get the subdomain footprint in one call instead of merging several CLI tools.
Asset inventory
Feed live hosts into scanners and screenshot tools so your inventory stays current.
Threat intel pivoting
Find sibling infrastructure around a phishing or malicious domain.
Change detection
Diff live hosts daily and alert on new or vanished ones.
Takeover checks
Spot hosts that point at a CNAME target you may no longer control.
Pricing
One key covers every endpoint, including /lookup with all five signals in one call. Billed monthly through RapidAPI.
Frequently asked questions
Is your Subdomain Enumeration API free?
Yes. The free tier includes 1,000 requests a month with no credit card. Paid plans start at $9.99/mo for 50,000 requests.
What data sources does this aggregate?
Certificate transparency logs (crt.sh, certspotter), passive DNS (hackertarget, rapiddns, VirusTotal), subfinder in the background (25+ passive sources) and DNS brute-force with about 770 common names across 8 public resolvers. Wildcard DNS is detected so it can't create false results.
What does live mean?
Every discovered name is resolved again. Names that resolve now go in live with their IP or CNAME target; the rest are historical names that stay in subdomains. On a domain's first lookup the live split is added by a background check and appears in the cached result about a minute later; until then sources_used shows liveness: enriching.
What if some upstream sources are down or rate-limited?
The other sources still answer and DNS brute-force always runs. sources_used shows each source's result: N found, enriching, rate-limited, unavailable or skipped.
Is this 'passive' enumeration or active scanning?
Mostly passive. CT logs and passive DNS are existing datasets. Brute-force and liveness checks are DNS queries through public resolvers (Cloudflare, Google, Quad9, OpenDNS). No requests go to the target's web servers.
How fresh are the results?
CT log data appears within minutes to hours of a certificate being issued; passive DNS varies by provider. Brute-force and liveness checks are live. Results are cached for 24 hours. Add ?wait=1 to wait for every source (up to about 25 seconds) instead of getting the fast result.
What's the rate limit?
Limits are monthly, per plan: 1,000 requests on BASIC, 50,000 on PRO, 500,000 on ULTRA and 5,000,000 on MEGA. On paid plans, requests over the quota are billed at the overage rate. Each response holds up to 2,000 names; count is always the full total.
Can I change the brute-force wordlist?
Not on the hosted API. If you self-host, edit the wordlist in app/subdomains.py in the MIT-licensed repo on GitHub.
How does this compare to Sublist3r, OWASP Amass, or Subfinder?
Those are CLI tools you install and run yourself. This is a hosted API that returns JSON, manages source keys such as VirusTotal, handles rate limits, and adds the live/historical split. Subfinder is one of its background sources.