Subdomains

Certificate Transparency (crt.sh, JSON) and optional HackerTarget hostsearch — only use with permission. Optionally probe first names with DNS (A/AAAA) and ICMP.

curl -sS 'https://tools.onesystems.ch/api/tools/subdomains?domain=example.com&probe=true'