Every hostname a domain has ever shown

Type an apex domain. Get back every subdomain several providers have observed — merged and de-duplicated, resolved over DNS, matched to its certificates, and scored for exposure.

placeholder

Trygithub.comstripe.comvercel.comdevbit.in

connecting to the live index…

    Certificate transparencyPassive DNSActive resolutionSAN groupingHygiene scoringChangefeed diffsCorroboration countsCSV + NDJSON export
    1. 01

      Fan out

      Certificate-transparency logs and passive-DNS providers are queried in parallel for one apex, each contributing names the others miss.

    2. 02

      Merge and enrich

      Results are de-duplicated, given structural attributes and a corroboration confidence, resolved over DNS, and matched to the certificates they appeared on.

    3. 03

      Persist and diff

      The dataset is stored, then compared against the previous pass to produce a changefeed and a fresh hygiene score. Repeat lookups get richer, not just faster.

    observedcdn.domainlens.devbit.in

    Built for the part after the list

    A raw dump of forty thousand hostnames is not a finding. Every lookup comes back scored, with the findings behind the score and what moved since the last pass.

    domainlens.devbit.inSample report

    Hygiene score

    82/ 100B

    4 findings, 1 of them high severity

    • Certificate hygiene88
    • Takeover risk54
    • Sensitive exposure71
    • Attack-surface shape93
    • Source corroboration96

    Findings

    • high

      CNAME points at example-shop.azurewebsites.net, which no longer exists. Whoever claims that name serves this host.

      shop.domainlens.devbit.inTakeover risk

    • medium

      A CI server's name resolves publicly, to 203.0.113.24.

      jenkins.domainlens.devbit.inSensitive exposure

    • low

      Certificate expires in 9 days.

      vpn.domainlens.devbit.inCertificate hygiene

    • info

      Reported by one source only.

      old-mail.domainlens.devbit.inSource corroboration

    Changes in the last refresh

    • Discoveredstaging-api.domainlens.devbit.in
    • New certificate*.domainlens.devbit.in
    • Started resolvinggrafana.domainlens.devbit.in
    • Stopped resolvinglegacy.domainlens.devbit.in
    • Score changed86 → 82

    • Observed, then resolved

      Every name is re-resolved on a schedule, so you can filter to what is live today rather than what once appeared in a log.

    • Certificate lifecycle

      Issuer, validity window, days to expiry and the full SAN group — the set of names that shared one certificate, which is usually one deployment.

    • Corroborated across sources

      Several providers are queried and merged, so each hostname carries how many independent sources saw it. A name one source reported is a weaker signal than one four agree on.

    • Export what you filtered

      Filtering and sorting happen server-side, so a CSV or newline-delimited export is the full result set in the same order as the page.

    The same dataset, straight from your terminal

    Every panel on this site is one HTTP call. Reads need no credentials, and the X-Cache header tells you whether Redis, Postgres or a live provider fan-out answered.

    Read the API reference
    Explore the index
    domainlens — bash

    The surface is wider than the inventory

    Sweep across the panel — or focus it and let it open.

    Not every host on them.

    You know your domains.

    Start with one domain

    No account and no key to read or export — every hostname, certificate and score is free. Sign in for higher rate limits, API keys and security audits.

    placeholder