>5B subdomains.
One API call.

Certificate Transparency, passive DNS, and X.509 data folded into a single index. Zero active scanning, zero SDK lock-in, plain-text output. Built for curl and the kind of operator who reads response bodies before reading docs. 

curl https://api.sub.md/v1/search?apex=example.com

admin.example.com
dev-cluster-01.internal.example.com
jenkins.k8s.example.com
staging-api.us-east-1.example.com
...

What sub.md replaces

The slow, noisy, often-blocked enumeration step. What you do with the names afterwards is the work that actually matters.

amass enum -d target -active -brute
one curl, plain-text out, no Go toolchain
subfinder + chaos + assetfinder + 12 API keys
one Bearer, every observed name we've ever seen
DNS bruteforce wordlists
apex name in, every observed sub out
stitching CT log mirrors + passive DNS + archived zones yourself
we did. continuously. years deep.

Pricing

Anonymous access works out of the box. API keys unlock higher limits.

Community
Free
  • 50 queries / day
  • 1 req/s
  • Plain text output
  • No key required
Researcher
€39/mo
  • 5,000 queries / month
  • 5 req/s
  • Bearer token auth
  • Priority support
Professional
€149/mo
  • 100K queries / month
  • 20 req/s
  • Bearer token auth
  • Bulk export
Architect
€500/mo
  • 2M queries / month
  • 100 req/s
  • Dedicated support
  • Custom SLA

ASM dashboard Coming soon

Continuous attack surface monitoring on top of the sub.md index. Track new subdomains, certificate changes, and exposed services across your entire portfolio.

Get an API key
30-day access, no subscription - pay once, renew when you need to. Heavy hitters: see Advanced plans.

FAQ

Short answers to recurring questions.

What counts as a query?
One call to GET /v1/search?apex=…. Cached responses and 304 Not Modified still count against your monthly quota.
Do you store my queries?
We log method, status, and truncated client IP for abuse handling. We do not log full query strings or tokens. See security.txt.
What's the Fair-Use Policy on the Firehose plan?
Don't be a dick. A while true; do curl …apex=google.com; done loop that produces nothing useful will get rate-limited or revoked. The quota is for legitimate research and continuous monitoring, not for burning our DB so you can say you did.
Refunds?
If the API is actually broken and we can't fix it, email [email protected]. Otherwise no -- it's a one-shot 30/90/180/365-day purchase, not a subscription.
Can I share my token across machines?
Yes. The quota is per token, not per IP.
Partners
Passguard