PAGES
← all tools
◆ Reconnaissance & OSINT

findomain

9.0.0 open-source

Findomain is a subdomain enumeration tool that uses Certificate TransparencyCertificate TransparencyA public, append-only log system maintained by various operators (Google runs several) that records every TLS certificate issued, letting anyone audit CAs for misissued or rogue certificates. logs and 54 passive APIs to discover subdomains.

Summary

Findomain is an open-source subdomain enumeration tool that queries Certificate Transparency logs and third-party APIs to find subdomains belonging to a target domain, and it is free to use. It runs as a command-line tool, with monitoring output pushed to Discord, Slack, or Telegram webhooks so results can feed into an existing alerting setup. It fits reconnaissance and OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. work, making it a fit for red teamers, bug bounty hunters, and asset-discovery teams tracking a domain's exposed surface over time. It sits in the subdomain enumeration and asset-discovery category alongside other recon tooling, resolving subdomains in parallel and supporting DNS over TLSDNS over TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext.. First committed in 2019, it has drawn 24 contributors and 49 commits in the past year across 14 releases, though the most recent release was 389 days ago.

Findomain is a subdomain enumeration tool that uses Certificate Transparency logs and 54 passive APIs to discover subdomains.

How findomain helps

Which subdomains exist for a domain that I don't already know about?

queries Certificate Transparency logs and dozens of passive APIs in parallel, returning every subdomain those sources have seen for the target

Has a target domain grown new subdomains since I last checked?

runs on a schedule and pushes new findings to a Discord, Slack, or Telegram webhook, so a growing attack surface shows up as an alert rather than requiring a re-scan

Which of these discovered subdomains are actually alive?

resolves the found subdomains in parallel, using DNS over TLS if configured, and reports which names resolve versus which are dead

Can I fold subdomains I already gathered from another tool into this scan?

accepts imported subdomain lists from other tools and resolves them alongside what it discovers itself

Do I need to query over IPv4 or IPv6 specifically to match my network setup?

supports restricting queries to a specific IP version, so results reflect the resolution path actually available on the box running it

all 18 features, with the evidence for each →

Languages

Not documented

Features

18 capabilities across 2 capability groups

Built from findomain's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • findomain covers 2 of the 13 network discovery and scanning capabilities we track.

What findomain offers you

  • Command-line interface2
  • Outbound webhooks (the product notifies you)2
Subdomain enumeration 5 features Network discovery and scanning since 2019
Subdomain discovery sources shipped Discovers subdomains by querying passive APIs (including Spyse and Bufferover) and Certificate Transparency logs. 22 releases · 2 other sources · first seen Aug 2019

Shared capability: Subdomain enumeration

release 22 total

  • Adds FullHunt.io as a new source for subdomain enumeration. 6.1.0 · Feb 2022 · source · release history
  • Update Spyse API version integration 6.0.0 · Feb 2022 · source · release history
  • Add Bufferover API support for subdomain discovery (both free and paid keys) 6.0.0 · Feb 2022 · source · release history
  • Supports providing multiple API keys via config or environment variables, which are now randomly selected and rotated per request. 4.1.0 · Apr 2021 · source · release history
  • --certspotter-key argument enables integration with the CertSpotter API using a provided key. 4.0.1 · Mar 2021 · source · release history
  • Adds new source support for webarchive, c99, and ctsearch 3.0.0 · Jan 2021 · source · release history

docs

  • Subdomain enumeration tool that queries Certificate Transparency logs and 54 passive APIs to discover subdomains, with monitoring, port scanning, and alerting s

example

  • Provide a CertSpotter API key to enable enumeration via that specific source. findomain --certspotter-key <API_KEY> -t example.com 4.0.1 · Mar 2021 · source
Telegram alerting shipped Sends full JSON data payloads to configured Telegram alerts for subdomain discovery events. 8 releases · 2 other sources · first seen Jul 2019

Shared capability: Subdomain enumeration

release 8 total

  • Enables sending full JSON data payloads to Telegram alerts 9.0.0 · Apr 2023 · source · release history
  • Threadcrowd API added as a new data source for subdomain enumeration. 0.2.5 · Sep 2019 · source · release history
  • The -a/--all-apis option has been removed. 0.2.5 · Sep 2019 · source · release history
  • Added --facebook-token flag to use built-in Facebook tokens 0.2.4 · Aug 2019 · source · release history
  • Introduces the -a CLI option to explicitly specify which subdomain enumeration APIs to use 0.1.4 · Jul 2019 · source · release history
  • Adds support for the VirusTotal (www.virustotal.com) API 0.1.4 · Jul 2019 · source · release history

example

  • Query only crt.sh and VirusTotal sources to reduce noise or avoid rate limits on other APIs. findomain -t target.com -a crt.sh,virustotal 0.1.4 · Jul 2019 · source
  • Run a scan using the new sublist3r API integration. findomain -t target.com -a sublist3r 0.1.4 · Jul 2019 · source
Subdomain monitoring shipped Continuously scans for new subdomains and pushes alerts via webhooks. 7 releases · 1 other source · first seen Sep 2019

Shared capability: Subdomain enumeration

Also counts toward: Command-line interface, Outbound webhooks (the product notifies you)

release 7 total

  • Adds --light-monitoring optional flag for light monitoring mode 3.0.0 · Jan 2021 · source · release history
  • Adds ability to skip monitoring mode while pushing to the database 3.0.0 · Jan 2021 · source · release history
  • Webhook publishing now checks for new findings; if no new subdomains are detected during a monitoring run, no webhook message is sent. 0.9.7 · Jan 2020 · source · release history
  • Added support for publishing data to Telegram webhooks 0.5.0 · Oct 2019 · source · release history
  • Print number of new subdomains found when posting to webhooks 0.4.1 · Oct 2019 · source · release history
  • Enables pushing monitoring alerts to Slack or Discord via webhook URLs passed as CLI arguments. 0.4.0 · Sep 2019 · source · release history

example

  • Enable light monitoring and set a custom HTTP timeout. findomain -t example.com --light-monitoring --http-timeout 30 3.0.0 · Jan 2021 · source
Bruteforce subdomain discovery shipped Discovers subdomains using custom wordlists with incremental or random modes. 2 releases · 2 other sources · first seen Feb 2020

Shared capability: Subdomain enumeration

release

  • --stdin flag allows piping targets directly into findomain via standard input. 4.0.1 · Mar 2021 · source · release history
  • Adds -w (wordlist), -i, and -r options to enable bruteforce-based subdomain discovery 1.4.0 · Feb 2020 · source · release history

example

  • Pipe a list of domains from another tool directly into findomain without temporary files. cat targets.txt | findomain --stdin -t / 4.0.1 · Mar 2021 · source
  • Discover subdomains using a custom wordlist with incremental or random modes to bypass naive defenses. findomain -t example.com -w wordlist.txt -i 1.4.0 · Feb 2020 · source
External subdomain integration shipped Automatically runs external enumeration tools (Amass and Subfinder) and processes their output within the workflow. 1 release · first seen Aug 2021

Shared capability: Subdomain enumeration

release

  • Adds the --external-subdomains CLI flag to automatically run Amass and Subfinder, process their output, and return only resolved, non-wildcard subdomains. 5.0.0 · Aug 2021 · source · release history
Attack surface inventory 2 features Network discovery and scanning since 2019
Import subdomains shipped Allows importing existing subdomain data from local files or other tools for further resolution and analysis. 3 releases · 2 other sources · first seen Apr 2019

Shared capability: Attack surface inventory

release

  • Adds the import_subdomains_from config key to define paths for importing subdomain data. 6.1.0 · Feb 2022 · source · release history
  • findomain now imports subdomains from a file via the -i/--input-file flag, allowing results from other tools (e.g., Amass, assetfinder) to be centralized and monitored. 0.8.0 · Nov 2019 · source · release history
  • Adds support for reading a list of domains from an input file to discover subdomains 0.1.2 · Apr 2019 · source · release history

example

  • Configure thread limits and import paths directly in the config file. # In your config file (default location or specified by FINDOMAIN_CONFIG_FILE): lightweight_threads = 10 screenshots_threads = 5 import_subdomains_from = ["/data/subdomains.txt"] 6.1.0 · Feb 2022 · source
  • Import subdomains from other tools and resolve findomain -t example.com --import-subdomains subfinder.txt amass.txt -r
Root domain inclusion shipped Ensures the base target domain is included in the output alongside discovered subdomains. 2 releases · first seen Mar 2020

Shared capability: Attack surface inventory

release

  • Adds root_domain field to the database schema 3.0.0 · Jan 2021 · source · release history
  • Add target root domain to subdomains list ensures the base domain itself is included in the output alongside discovered subdomains. 1.4.3 · Mar 2020 · source · release history
Other / not yet classified 11 features Features we have not matched to a capability yet. A suggested match is marked.
Download artifacts shipped Provides standardised download links and binary naming conventions for the tool's executable. 6 releases · first seen May 2019

release

  • Download URLs must now include .zip extension (e.g., findomain-linux becomes findomain-linux.zip) 8.1.0 · Apr 2022 · source · release history
  • The extracted binary is now named findomain instead of the platform-specific name (e.g., findomain-linux) 8.1.0 · Apr 2022 · source · release history
  • Allows writing output to a unique file for one or multiple targets. 0.3.0 · Sep 2019 · source · release history
  • TXT, CSV, and JSON output formats 0.1.3 · May 2019 · source · release history
  • New MacOS target platform support 0.1.3 · May 2019 · source · release history
  • New Windows target platform support 0.1.3 · May 2019 · source · release history
Validate subdomains shipped Validates collected subdomains against standard domain naming rules to ensure correctness before further processing. 4 releases · 2 other sources · first seen Apr 2019

release

  • Adds --validate flag to validate subdomains as valid domain names without performing any resolution tasks. 5.1.0 · Dec 2021 · source · release history
  • Exclude subdomains containing non ascii characters filters out results with unicode glyphs, reducing noise from internationalized domain names (IDN) or malformed entries. 1.4.3 · Mar 2020 · source · release history
  • Implemented sanitize_subdomains to filter out invalid characters (e.g., <br> tags) from API responses. 0.9.4 · Jan 2020 · source · release history
  • Enables display of resolved IP addresses in output (if available) 0.1.2 · Apr 2019 · source · release history

example

  • Validate a list of collected subdomains against standard domain naming rules before further processing. findomain --validate -f subdomains_file.txt -u valid_subdomains.txt 5.1.0 · Dec 2021 · source
  • Scan a single domain and get its subdomains with resolved IPs findomain -t example.com 0.1.2 · Apr 2019 · source
Screenshot capture shipped Captures screenshots of discovered subdomains, supporting standard URLs, specific ports, and scheme preservation. 3 releases · 2 other sources · first seen Jan 2021

release

  • Adds --no-resolve flag to skip DNS resolution when taking screenshots via --as-resolver/-x, allowing direct processing of https:// URLs 4.3.0 · May 2021 · source · release history
  • Screenshot capability now accepts targets in the HOST:PORT format. 4.2.0 · May 2021 · source · release history
  • Adds screenshots capture support for discovered subdomains 3.0.0 · Jan 2021 · source · release history

example

  • Screenshot a URL that already includes the scheme to avoid double-prefixing errors. findomain --screenshots https://example.com:443 4.2.0 · May 2021 · source
  • Capture screenshots of non-standard ports (e.g., 8080) by passing the host and port directly. findomain --screenshots example.com:8080 4.2.0 · May 2021 · source
Custom HTTP headers and resolvers shipped Allows customizing DNS resolvers, User Agent strings (including file rotation), and HTTP request timeouts. 3 releases · 1 other source · first seen Jan 2021

release

  • --user-agents-file option added to read user agent strings from a specified file for rotation. 4.0.1 · Mar 2021 · source · release history
  • Adds --dns-resolver flag to use custom DNS resolvers 3.0.0 · Jan 2021 · source · release history
  • Adds --user-agent flag to set a custom User Agent for requests 3.0.0 · Jan 2021 · source · release history

example

  • Specify a path to a file containing custom user agents to use for requests. findomain --user-agents-file ./agents.txt -t example.com 4.0.1 · Mar 2021 · source
Database management shipped Provides functionality to reset the internal database state to clear stored data. 3 releases · first seen Jan 2020

Also counts toward: Command-line interface

release

  • Adds --reset-database flag to reset the internal database state 9.0.0 · Apr 2023 · source · release history
  • Change database structure requires migration for existing installations. 3.0.0 · Jan 2021 · source · release history
  • PostgreSQL database entries now include a timestamp column, and the internal schema is updated to support this field. 0.9.7 · Jan 2020 · source · release history
Webhook alerting shipped suggested Sends HTTP webhook notifications with full JSON payloads for discovered subdomains, supporting conditional alerts based on host status. 2 releases · 1 other source · first seen Apr 2019

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

Also counts toward: Outbound webhooks (the product notifies you)

release

  • Enables sending full JSON data payloads to configured webhooks 9.0.0 · Apr 2023 · source · release history
  • Changes webhook alert behavior to only send notifications for alive hosts when IP discovery is active 8.0.0 · Apr 2022 · source · release history

example

  • Scan a single domain and get its subdomains with resolved IPs findomain -t example.com 0.1.2 · Apr 2019 · source
Target randomization and rate limiting shipped suggested Randomizes the order of target processing to avoid rate-limiting patterns and enforces request rate limits. 1 release · 1 other source · first seen Apr 2021

Suggested capability: Subdomain enumeration. This is our guess, not confirmed.

release

  • Adds --randomize CLI flag to randomize the order of provided targets during enumeration. 4.1.0 · Apr 2021 · source · release history

example

  • Run enumeration on a list of domains with randomized target order to avoid rate-limiting patterns. findomain --targets example.com test.org --randomize 4.1.0 · Apr 2021 · source
Configuration file management shipped Allows persistence of settings and source exclusions via a local configuration file. 2 releases · first seen Jun 2020

release

  • Adds exclude_sources setting to .findomainrc.yaml for persistent source exclusion configuration 1.7.0 · Jun 2020 · source · release history
  • Adds support for reading settings from a configuration file. 1.6.0 · Jun 2020 · source · release history
Output file configuration shipped suggested Configures the format and naming conventions for exported subdomain data files. 2 releases · first seen Sep 2019

Suggested capability: Subdomain enumeration. This is our guess, not confirmed.

release

  • The -o flag no longer accepts an explicit file extension; the tool now forces .txt and uses {target}.txt as the name. 0.2.8 · Sep 2019 · source · release history
  • Defaults all output files to TXT format 0.2.8 · Sep 2019 · source · release history
Wildcard DNS filtering shipped Detects and filters out wildcard DNS results to reduce false positives. 1 release · first seen Feb 2020

release

  • Adds wildcard detection to filter out wildcard DNS results for more accurate findings 1.4.0 · Feb 2020 · source · release history
Docker support shipped Provides a Dockerfile for container-based installation and execution of the cyber tool. 1 release · first seen Jan 2020

release

  • Dockerfile added to the repository, enabling container-based installation and execution of findomain. 0.9.7 · Jan 2020 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for findomain, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail findomain puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

41 entries

  1. April 20231
  2. April 20223
  3. February 20222
  4. December 20211
  5. August 20211
  6. May 20212
  7. April 20211
  8. March 20211
  9. January 20211
  10. July 20201
  11. June 20202
  12. March 20201
  13. February 20202
  14. January 20204
  15. November 20192
  16. October 20194
  17. September 20195
  18. August 20193
  19. July 20192
  20. May 20191
  21. April 20191
    Show

    41 entries

    Project health

    Issue, contributor and maintainer activity in Findomain/Findomain, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 2 ±0 vs prior 12 months
    2. Maintainers 1 +0 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 2.7 years first maintainer reply 21 hours
    6. Open backlog 2 of 164 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 2
    3. Contributors / month 1
    4. Commits / month 6
    5. Stars 3,795
    Issue themes, last 12 months
    • bugs 20%
    • other 80%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →