Subdomain Finder
Endpoints
Subdomains 1
Subdomains of a domain, with their IP addresses and Cloudflare status.
What is the Subdomain Finder API?
Find the subdomains of any domain, each with the IP address it resolves to and whether it is proxied by Cloudflare.
Subdomain Finder API is available on the JoJ API marketplace. Subscribe with a single JoJ API key, call it through one gateway, and pay from one wallet — no separate account or contract with the provider.
Subdomain Finder API endpoints
- GET
/v1/subdomain-finder/List Subdomains
Every subdomain found for a domain, each with the IPv4 address it resolves to (`null` when it did not resolve) and whether Cloudflare proxies it. Results can come from an earlier scan of the domain; `scan_date` (UTC) says when the subdomains were collected. Large domains return thousands of subdomains in one response. A URL is accepted in place of a domain and its host name is used. When no subdomains are found the status is 400 (`no_subdomains_found`); when the lookup cannot be completed the status is 503 (`service_unavailable`) and the request is not charged.
Frequently asked questions about Subdomain Finder API
What does the API return?
For a domain such as example.com, every subdomain found for it, each with the IPv4 address it resolves to and whether Cloudflare proxies it, plus scan_date: the moment (UTC) the subdomains were collected.
How fresh are the results?
Results can come from an earlier scan of the domain rather than a live one. scan_date tells you when the subdomains were collected, so you can decide whether the data is recent enough for your use.
Why is ip null for some subdomains?
The subdomain was found but did not resolve to an IPv4 address, for example because its DNS record was removed or points nowhere.
What does cloudflare: true mean?
The subdomain's address belongs to Cloudflare: its traffic is proxied through Cloudflare, so the origin server's own IP address is not visible.
Can I pass a URL instead of a domain?
Yes. For a URL such as https://example.com/page the host name is used.
Am I charged when a request fails?
No. A missing domain, text that cannot be a domain name, and lookups that cannot be completed (503 service_unavailable) are not charged. A completed lookup is charged once, including one that finds no subdomains.