Most teams cannot produce a current list of the subdomains they own. Attackers can, and they are patient enough to find the one CNAME you stopped maintaining years ago. Subpoof enumerates your subdomains, watches the zone files for newly-registered lookalikes of your brand, and alerts you the same day a typosquat goes live.
Free tier, no credit card. Passkey sign-in, no passwords to manage.
Every night, we capture the day's newly-registered domains across the global TLD space. Only the deltas, never the full namespace.
Each night's additions are tagged with TLD, date, and label structure, and indexed for keyword search across the full archive.
Filter new domains by date, TLD, or keyword. Plug directly into your threat-intel pipeline, SIEM, or custom tooling.
Web dashboard for searches, on-demand subdomain scans, lookalike monitoring, and webhook + email alerts on the changes you care about.
Subpoof excels at attack surface management for organizations with Microsoft-heavy environments and for hunting lookalikes or exposed services. Tenant mapping and NTLM discovery are standout capabilities not common in basic subdomain tools.
Install the official subpoof skill and run scans, pull new-registration feeds, and query your subdomain history in plain language, without leaving your AI session. Claude makes the API calls, paginates, and summarizes the findings. The skill is open source and reads your API key from the environment.
subpoof runs a hosted MCP server, so Claude Desktop, Cursor, and any other MCP client can use the API as native tools, resources, and prompts. Submit scans, pull new-registration feeds, and query your subdomain history straight from the assistant. Authenticate with your API key as a bearer token; usage counts against the same plan quota.
No per-query surprises. Pay for the access level you need.
Start monitoring for free. No credit card required. Sign in with a passkey.