Discover subdomains for any domain using multiple reconnaissance techniques. Returns a list of found subdomains with their IP addresses.
{
"status": "ok",
"error": null,
"data": {
"rootDomain": {
"domain": "paypal.com",
"records": [
"151.101.3.1",
"151.101.195.1",
"162.159.141.96"
]
},
"subDomains": [
{
"host": "api.paypal.com",
"records": [
"66.211.168.123"
]
},
{
"host": "mail.paypal.com",
"records": [
"159.127.187.12"
]
},
{
"host": "admin.paypal.com",
"records": [
"173.0.88.10"
]
},
{
"host": "smtp.paypal.com",
"records": [
"64.4.244.68"
]
},
{
"host": "ns2.paypal.com",
"records": [
"64.4.244.71"
]
},
{
"host": "test.paypal.com",
"records": [
"156.59.125.88"
]
},
{
"host": "ns1.paypal.com",
"records": [
"64.4.244.70"
]
},
{
"host": "mx.paypal.com",
"records": [
"10.190.3.55"
]
},
{
"host": "demo.paypal.com",
"records": [
"151.101.1.21",
"151.101.193.21",
"151.101.129.21",
"151.101.65.21"
]
},
{
"host": "shop.paypal.com",
"records": [
"54.148.26.111",
"35.80.170.143",
"54.212.145.128"
]
},
{
"host": "www.paypal.com",
"records": [
"151.101.193.21",
"151.101.65.21",
"151.101.129.21",
"151.101.1.21"
]
},
{
"host": "m.paypal.com",
"records": [
"151.101.129.21",
"151.101.1.21",
"151.101.193.21",
"151.101.65.21"
]
},
{
"host": "stage.paypal.com",
"records": [
"64.4.241.16"
]
},
{
"host": "ssl.paypal.com",
"records": [
"151.101.65.21",
"151.101.129.21",
"151.101.193.21",
"151.101.1.21"
]
},
{
"host": "i.paypal.com",
"records": [
"63.140.38.107",
"63.140.39.244",
"63.140.39.114",
"63.140.38.116",
"63.140.39.254",
"63.140.39.146",
"63.140.38.213",
"63.140.39.214",
"63.140.39.87",
"63.140.39.123"
]
},
{
"host": "news.paypal.com",
"records": [
"192.243.228.1"
]
},
{
"host": "autodiscover.paypal.com",
"records": [
"52.96.79.120",
"52.96.79.200",
"52.96.163.40",
"52.96.79.248"
]
},
{
"host": "dl.paypal.com",
"records": [
"216.113.188.115"
]
},
{
"host": "connect.paypal.com",
"records": [
"151.101.65.21",
"151.101.129.21",
"151.101.1.21",
"151.101.193.21"
]
},
{
"host": "sandbox.paypal.com",
"records": [
"151.101.195.1",
"162.159.141.96",
"151.101.3.1"
]
},
{
"host": "training.paypal.com",
"records": [
"64.4.254.252"
]
},
{
"host": "c.paypal.com",
"records": [
"151.101.129.21",
"151.101.65.21",
"151.101.193.21",
"151.101.1.21"
]
},
{
"host": "business.paypal.com",
"records": [
"104.18.6.168",
"104.18.7.168"
]
},
{
"host": "service.paypal.com",
"records": [
"192.243.228.1"
]
},
{
"host": "login.paypal.com",
"records": []
},
{
"host": "t.paypal.com",
"records": [
"151.101.3.1",
"151.101.131.1",
"151.101.67.1",
"151.101.195.1"
]
},
{
"host": "status.paypal.com",
"records": [
"20.69.68.249"
]
},
{
"host": "shopping.paypal.com",
"records": [
"208.76.140.165"
]
},
{
"host": "newsletter.paypal.com",
"records": [
"192.243.228.1"
]
},
{
"host": "reports.paypal.com",
"records": [
"173.0.93.28"
]
},
{
"host": "forms.paypal.com",
"records": [
"216.113.190.190"
]
},
{
"host": "labs.paypal.com",
"records": [
"173.0.88.135"
]
},
{
"host": "p.paypal.com",
"records": [
"151.101.131.1",
"151.101.67.1",
"151.101.195.1",
"151.101.3.1"
]
},
{
"host": "transfer.paypal.com",
"records": [
"151.101.193.21",
"151.101.129.21",
"151.101.65.21",
"151.101.1.21"
]
},
{
"host": "xmpp.paypal.com",
"records": [
"173.224.160.144",
"173.224.160.141",
"185.97.80.137",
"185.97.80.136"
]
},
{
"host": "manager.paypal.com",
"records": [
"173.0.93.191"
]
},
{
"host": "developer.paypal.com",
"records": [
"151.101.1.21",
"151.101.193.21",
"151.101.129.21",
"151.101.65.21"
]
},
{
"host": "account.paypal.com",
"records": [
"192.243.228.1"
]
},
{
"host": "history.paypal.com",
"records": [
"151.101.129.21",
"151.101.193.21",
"151.101.65.21",
"151.101.1.21"
]
},
{
"host": "pics.paypal.com",
"records": [
"151.101.131.1",
"151.101.195.1",
"151.101.67.1",
"151.101.3.1"
]
},
{
"host": "registration.paypal.com",
"records": [
"173.0.93.135"
]
},
{
"host": "mcp.paypal.com",
"records": [
"104.18.7.170",
"104.18.6.170"
]
},
{
"host": "accounts.paypal.com",
"records": [
"173.0.93.28"
]
},
{
"host": "hotspot.paypal.com",
"records": [
"64.4.240.12"
]
},
{
"host": "bm.paypal.com",
"records": [
"130.211.16.153"
]
},
{
"host": "rms.paypal.com",
"records": [
"173.0.82.166"
]
},
{
"host": "cb.paypal.com",
"records": [
"173.0.88.142"
]
}
],
"count": 47,
"totalFound": 47
}
}
Discover subdomains for any domain using multiple reconnaissance techniques. Returns a list of found subdomains with their IP addresses.
A single authenticated GET with the location you care about — no SDK required.
GET /v1/subdomainfinder?query=… x-api-key: your_key
Each request pulls from multiple upstream sources and computes the derived fields for you.
One structured object, typically under 200 ms — ready to render.
{ rootDomain, subDomains, count, … }
Real applications shipping on this endpoint today — each with the numbers that made it worth wiring up.
See every use caseEnumerate all subdomains to identify the complete attack surface for security assessment.
Periodically enumerate subdomains and compare against known inventory to find gaps.
Copy a working request, or install a typed SDK. Same endpoint, same key.
const res = await fetch("https://api.apiverve.com/v1/subdomainfinder?domain=google.com&limit=5", {
headers: { "x-api-key": "YOUR_API_KEY" },
});
const { data } = await res.json();
console.log(data);Every related API ships with your key — no separate plans, no extra keys, one bill.
See pricingReady-made recipes for Zapier, Make, and n8n — trigger on an event, and the data lands where your team works.
The same key unlocks every other APIVerve endpoint — reach for them when you need them.
Browse the catalog