openSquat detects look-alike domains that resemble an organization’s legitimate domains, helping identify possible impersonation.
Open source
12 alternativesSubhunt
github.com/ahmadouniass/Subdomains-finder-subh…
Website & URL Scanners
Open-source projectOpen source
Subhunt enumerates subdomains using passive sources such as certificate transparency records.
About Subhunt
Subhunt is an open-source Python command-line tool that enumerates subdomains for a target domain using passive sources: crt.sh certificate transparency logs, HackerTarget, and RapidDNS. It merges and deduplicates results, strips wildcard prefixes, and validates entries against the target scope.
It can optionally probe subdomains for HTTP/HTTPS liveness and filter output to reachable hosts. Results can be exported to TXT, JSON, or CSV, and enumeration depends on the availability of its external sources.
Key features
- Collects subdomains from crt.sh, HackerTarget, and RapidDNS
- Merges, deduplicates, and scope-validates enumerated subdomains
- Probes subdomains for HTTP/HTTPS liveness with status codes
- Filters output and exports to alive hosts only
- Exports results to TXT, JSON, and CSV
- Falls back to other sources if crt.sh is down
Best for: Bug bounty hunters, penetration testers, and security researchers performing subdomain reconnaissance.
Good for
- Combines three passive sources with automatic merging and deduplication
- Includes HTTPS-first liveness probing with alive-only filtering
- Supports TXT, JSON, and CSV export with configurable network options
Watch out for
- Relies on third-party sources crt.sh, HackerTarget, and RapidDNS
- Alive-only output requires enabling liveness probing
- Must be installed and run locally with Python dependencies
Subhunt at a glance
- Category
- Privacy & Security › Website & URL Scanners
- Type
- Open-source project
- Pricing
- Not confirmed. Check the site
- Open source
- Yes · Source code
- Language
- English
- Last checked
- Oct 6, 2026 · Online when checked
- Listed
- Oct 5, 2026
Subhunt alternatives
Tools and sites you could use instead, ranked by how closely they match.
Discover subdomains and review DNS history through the Columbus subdomain discovery service.
Open sourcePick
7 alternatives
dnsx provides a fast DNS reconnaissance toolkit for resolving records and collecting DNS information from domains.
Open source
12 alternatives
Check whether an IP address is associated with a VPN, proxy, Tor, or bot through Focsec’s detection API.
Free trial
7 alternatives
Passive subdomain reconnaissance for authorized testing is available through openSquat, a framework written in Rust.
Enumerate available domains generated modifying the original domain name through different cybersquatting techniques
Open source
6 alternativesPopular in Website & URL Scanners
Well-known listings from the same topic.
InfoSniperinfosniper.netWho.iswho.isRobtexrobtex.comQuantcastquantcast.comWeb Checkweb-check.as93.netFullHuntfullhunt.io
Subhunt FAQ
What sources does Subhunt use for enumeration?
crt.sh certificate transparency logs, HackerTarget, and RapidDNS, with results merged and deduplicated.
How do I export only reachable subdomains?
Run with --probe and --alive-only to display and export alive hosts only.
Which export formats are supported?
TXT, JSON, and CSV, with the output directory set by --output-dir.
Is something wrong or out of date?
Tell us and an editor will check it.
Own this website?
Claim this listing
Claim the listing and suggest updates yourself. An editor checks every claim first.