Question 1

What does the API return?

Accepted Answer

For a domain such as example.com, every subdomain found for it, each with the IPv4 address it resolves to and whether Cloudflare proxies it, plus scan_date: the moment (UTC) the subdomains were collected.

Question 2

How fresh are the results?

Accepted Answer

Results can come from an earlier scan of the domain rather than a live one. scan_date tells you when the subdomains were collected, so you can decide whether the data is recent enough for your use.

Question 3

Why is ip null for some subdomains?

Accepted Answer

The subdomain was found but did not resolve to an IPv4 address, for example because its DNS record was removed or points nowhere.

Question 4

What does cloudflare: true mean?

Accepted Answer

The subdomain's address belongs to Cloudflare: its traffic is proxied through Cloudflare, so the origin server's own IP address is not visible.

Question 5

Can I pass a URL instead of a domain?

Accepted Answer

Yes. For a URL such as https://example.com/page the host name is used.

Question 6

Am I charged when a request fails?

Accepted Answer

No. A missing domain, text that cannot be a domain name, and lookups that cannot be completed (503 service_unavailable) are not charged. A completed lookup is charged once, including one that finds no subdomains.

Subdomain Finder

Frequently Asked Questions