APIVerve

Subdomain Finder API

GET
DocsGet a free API key →

Map every active subdomain and IP address for any domain.

Subdomain Finder discovers active subdomains and their resolved IP addresses for any target domain. It checks certificate transparency logs and common hostnames, returning matched hostnames, root A records, and scan completion status.

Try it — live request, no key required

Request
GETapi.apiverve.com/v1/subdomainfinder?domain=paypal.com
Query parameters
Verification
Format

No key required to try it. Get a key to use it in your app.

Example
{
  "status": "ok",
  "error": null,
  "data": {
    "rootDomain": {
      "domain": "paypal.com",
      "records": [
        "151.101.3.1",
        "151.101.195.1",
        "162.159.141.96"
      ]
    },
    "subDomains": [
      {
        "host": "api.paypal.com",
        "records": [
          "66.211.168.123"
        ]
      },
      {
        "host": "mail.paypal.com",
        "records": [
          "159.127.187.12"
        ]
      },
      {
        "host": "admin.paypal.com",
        "records": [
          "173.0.88.10"
        ]
      },
      {
        "host": "smtp.paypal.com",
        "records": [
          "64.4.244.68"
        ]
      },
      {
        "host": "ns2.paypal.com",
        "records": [
          "64.4.244.71"
        ]
      },
      {
        "host": "test.paypal.com",
        "records": [
          "156.59.125.88"
        ]
      },
      {
        "host": "ns1.paypal.com",
        "records": [
          "64.4.244.70"
        ]
      },
      {
        "host": "mx.paypal.com",
        "records": [
          "10.190.3.55"
        ]
      },
      {
        "host": "demo.paypal.com",
        "records": [
          "151.101.1.21",
          "151.101.193.21",
          "151.101.129.21",
          "151.101.65.21"
        ]
      },
      {
        "host": "shop.paypal.com",
        "records": [
          "54.148.26.111",
          "35.80.170.143",
          "54.212.145.128"
        ]
      },
      {
        "host": "www.paypal.com",
        "records": [
          "151.101.193.21",
          "151.101.65.21",
          "151.101.129.21",
          "151.101.1.21"
        ]
      },
      {
        "host": "m.paypal.com",
        "records": [
          "151.101.129.21",
          "151.101.1.21",
          "151.101.193.21",
          "151.101.65.21"
        ]
      },
      {
        "host": "stage.paypal.com",
        "records": [
          "64.4.241.16"
        ]
      },
      {
        "host": "ssl.paypal.com",
        "records": [
          "151.101.65.21",
          "151.101.129.21",
          "151.101.193.21",
          "151.101.1.21"
        ]
      },
      {
        "host": "i.paypal.com",
        "records": [
          "63.140.38.107",
          "63.140.39.244",
          "63.140.39.114",
          "63.140.38.116",
          "63.140.39.254",
          "63.140.39.146",
          "63.140.38.213",
          "63.140.39.214",
          "63.140.39.87",
          "63.140.39.123"
        ]
      },
      {
        "host": "news.paypal.com",
        "records": [
          "192.243.228.1"
        ]
      },
      {
        "host": "autodiscover.paypal.com",
        "records": [
          "52.96.79.120",
          "52.96.79.200",
          "52.96.163.40",
          "52.96.79.248"
        ]
      },
      {
        "host": "dl.paypal.com",
        "records": [
          "216.113.188.115"
        ]
      },
      {
        "host": "connect.paypal.com",
        "records": [
          "151.101.65.21",
          "151.101.129.21",
          "151.101.1.21",
          "151.101.193.21"
        ]
      },
      {
        "host": "sandbox.paypal.com",
        "records": [
          "151.101.195.1",
          "162.159.141.96",
          "151.101.3.1"
        ]
      },
      {
        "host": "training.paypal.com",
        "records": [
          "64.4.254.252"
        ]
      },
      {
        "host": "c.paypal.com",
        "records": [
          "151.101.129.21",
          "151.101.65.21",
          "151.101.193.21",
          "151.101.1.21"
        ]
      },
      {
        "host": "business.paypal.com",
        "records": [
          "104.18.6.168",
          "104.18.7.168"
        ]
      },
      {
        "host": "service.paypal.com",
        "records": [
          "192.243.228.1"
        ]
      },
      {
        "host": "login.paypal.com",
        "records": []
      },
      {
        "host": "t.paypal.com",
        "records": [
          "151.101.3.1",
          "151.101.131.1",
          "151.101.67.1",
          "151.101.195.1"
        ]
      },
      {
        "host": "status.paypal.com",
        "records": [
          "20.69.68.249"
        ]
      },
      {
        "host": "shopping.paypal.com",
        "records": [
          "208.76.140.165"
        ]
      },
      {
        "host": "newsletter.paypal.com",
        "records": [
          "192.243.228.1"
        ]
      },
      {
        "host": "reports.paypal.com",
        "records": [
          "173.0.93.28"
        ]
      },
      {
        "host": "forms.paypal.com",
        "records": [
          "216.113.190.190"
        ]
      },
      {
        "host": "labs.paypal.com",
        "records": [
          "173.0.88.135"
        ]
      },
      {
        "host": "p.paypal.com",
        "records": [
          "151.101.131.1",
          "151.101.67.1",
          "151.101.195.1",
          "151.101.3.1"
        ]
      },
      {
        "host": "transfer.paypal.com",
        "records": [
          "151.101.193.21",
          "151.101.129.21",
          "151.101.65.21",
          "151.101.1.21"
        ]
      },
      {
        "host": "xmpp.paypal.com",
        "records": [
          "173.224.160.144",
          "173.224.160.141",
          "185.97.80.137",
          "185.97.80.136"
        ]
      },
      {
        "host": "manager.paypal.com",
        "records": [
          "173.0.93.191"
        ]
      },
      {
        "host": "developer.paypal.com",
        "records": [
          "151.101.1.21",
          "151.101.193.21",
          "151.101.129.21",
          "151.101.65.21"
        ]
      },
      {
        "host": "account.paypal.com",
        "records": [
          "192.243.228.1"
        ]
      },
      {
        "host": "history.paypal.com",
        "records": [
          "151.101.129.21",
          "151.101.193.21",
          "151.101.65.21",
          "151.101.1.21"
        ]
      },
      {
        "host": "pics.paypal.com",
        "records": [
          "151.101.131.1",
          "151.101.195.1",
          "151.101.67.1",
          "151.101.3.1"
        ]
      },
      {
        "host": "registration.paypal.com",
        "records": [
          "173.0.93.135"
        ]
      },
      {
        "host": "mcp.paypal.com",
        "records": [
          "104.18.7.170",
          "104.18.6.170"
        ]
      },
      {
        "host": "accounts.paypal.com",
        "records": [
          "173.0.93.28"
        ]
      },
      {
        "host": "hotspot.paypal.com",
        "records": [
          "64.4.240.12"
        ]
      },
      {
        "host": "bm.paypal.com",
        "records": [
          "130.211.16.153"
        ]
      },
      {
        "host": "rms.paypal.com",
        "records": [
          "173.0.82.166"
        ]
      },
      {
        "host": "cb.paypal.com",
        "records": [
          "173.0.88.142"
        ]
      }
    ],
    "count": 47,
    "totalFound": 47,
    "complete": true
  }
}

About the Subdomain Finder API

Pass a root domain to query certificate transparency entries and common hostnames in real time. The response pairs each discovered host with its resolved IP addresses, including root domain records and a completion status flag. When queries hit the scan time limit, a note explains truncation. Paid plans can increase detection limits and enable deep wordlist scans.

What people use it for

Attack Surface Discovery
Security engineers scan an organization's primary domain to find forgotten staging hosts and catalog exposed IP addresses before running vulnerability assessments.
Asset Inventory Auditing
When auditing corporate infrastructure, IT teams cross-reference discovered subdomain hostnames against internal DNS registers to catch untracked servers and shadow services.
Bug Bounty Reconnaissance
Penetration testers submit client domains to map newly issued certificates and gather resolved hostnames prior to testing web applications.
Phishing Infrastructure Detection
To catch spoofing campaigns, brand protection platforms query suspicious root domains to inspect resolving hostnames and flag active servers.

Ways to call it

One endpoint, many ways in — REST with JSON, XML, YAML and CSV, plus GraphQL and an MCP interface for AI agents.

JSON
Default REST response
XML
Markup format
YAML
Human-readable
CSV
Tabular export
Beta
GraphQL
Query language
New
MCP
For AI agents
View all integrations →

Other ways to use Subdomain Finder

Same data, same APIVerve account, same credit balance — one key works on all of them.

Give it to an AI agentConnect over MCP and your agent calls it as a native tool — Claude, Cursor, ChatGPT.on VerveKit Google Sheets or ExcelA =VERVE() formula fills a column — no script, no export, recalculates in place.on VerveSheets Ground an agent on itA cited, machine-checkable fact your model can't produce on its own.on VerveContext

Questions.

Common questions about the Subdomain Finder API.

Read the docs →
Is it cheap enough to scan subdomains for every domain in my list?
Each scan costs 100 credits, which works out to about $0.015 per call on the Starter plan or $14.99 per 1,000 scans. That entry plan provides 2,000 scans every month. If you are evaluating the tool first, the Free plan includes 2 scans per month.
Can I run deep wordlist scans or limit result counts on the Free plan?
No. The deep scan option and custom result limits require a paid plan. Any paid subscription, starting with Starter, unlocks both parameters so you can search the full wordlist and cap your results.
What happens if a domain has too many subdomains to finish scanning?
The response returns whatever subdomains were discovered before the scan hit its limit, with the complete field set to false. The total found count will state that a time or result limit was reached, and a note field will explain how to search deeper.
Does the scan resolve IP addresses for discovered subdomains?
Yes. Each discovered entry includes its full hostname along with its resolved IP records. The response also provides the resolved IP addresses for the root domain itself.
Can I use discovered subdomain records inside a commercial security tool?
Yes, provided you are subscribed to a paid plan. Free plan usage is limited to non-commercial testing. You may display and analyze the scan output directly within your own software, but you cannot resell or redistribute the raw scan data as-is.
More in this category

Domain Data

View all 18 →
Browse by category
Finance 49Text Processing 45Data Conversion 33Data Generation 32Entertainment 24Games 21Data Lookup 17Networking 14Geography 13Reference Data 11Data Validation 9Weather 8Math/Calculations 8Images 7AI/Computer Vision 6Astrology 6Data Processing 6Transportation 6Data Scraping 5Calendar 5Security 4Science 4Parsers 4Documents 3Food 3Lifestyle 3Health/Wellness 2News 1All 367 APIs →

Related articles

All articles →
Attack Surface: The Subdomains You Forgot You HadYour main site is secure, but what about staging.yourcompany.com? Here's why subdomain discovery matters.Read 7 SSL Certificate Problems That Kill TrustExpired certs, mismatched domains, weak encryption. A practical checklist for catching SSL issues before your users do.Read DNS Lookups: A Developer's Debugging GuideDNS problems cause connection failures and email issues. Learn how to use DNS lookups to diagnose problems faster.Read

Ready to build with Subdomain Finder? Start with 200 free credits — one key unlocks all 300+ APIs.

Get a free API key→View pricing

Explore the catalog

300+ APIs on the same key and the same response shape.

Browse all APIs