Skip to content
Subdomain API logo

Subdomain API

Returns known subdomains of any domain from a historic index, served as JSON through an API and an MCP server.

APISecurityFree tier
subdomain.app ↗
At a glanceswept 2026-10-12

not read yet

Use

For
Security researchers, pentesters and bug bounty hunters mapping a domain's attack surface, plus IT and SEO teams tracking its footprint.
Price
Price not read
Activity
Activity not read yet
Company
Domain since 2023domain registered
Runs as
API
AlternativesSet it up for my teamIs Subdomain API yours? Claim the card →
What people do with it
  • map a target's attack surface during pentests
  • find forgotten subdomains during bug bounty research
  • track how a domain's subdomains change over time
The companyeach fact with its source · read 2026-10-14
  • Domain since2023domain registered
How a program reaches itfound, not claimed · read 2026-10-14

MCP server details →

Each line is something a program found when it went looking: the registry entry, the server's own answer, a spec that parses. A missing line means we did not find it, not that it does not exist.

Questions this page answers
  • What is Subdomain API?

    Returns known subdomains of any domain from a historic index, served as JSON through an API and an MCP server.

  • Who is Subdomain API for?

    Security researchers, pentesters and bug bounty hunters mapping a domain's attack surface, plus IT and SEO teams tracking its footprint.

  • Do people use Subdomain API?

    Little sign of use.

Not quite it? Describe the job

beta

Five tools from the Atlas that fit it, each judged against what you wrote.

How we read a tool

No votes, no reviews, no vendor claims. Every week a crawler reads each tool's own site and a few public registries, and the words on the card are bands over what it read.

  • Use: visits to the site (estimated), installs from npm and PyPI, presence in Chrome's usage report.
  • Activity: the newest release on GitHub, npm or PyPI; the newest dated page on the site; open roles on a public jobs board.
  • Price: the vendor's own pricing page, read with the date. A figure is printed only when it is on that page.
  • The line and the use cases are written by us from the homepage, one tool at a time, and refused when they repeat the vendor's marketing.

How AI assistants read each site — the reading vendors ask us about — is on each tool's own visibility page.