PugRecon
Find exposed names fast enough to act on.
Search subdomains and public cloud buckets, then export clean name lists for scanners, notes, and reports.
Reconnaissance desk, 2026.
Search in, names out.
Domain or subdomain
example.com
Run query
Export
pugrecon_subdomains_example.com.txt
The free plan, spelled out.
Free plan
50 credits per month
Free result cap
30 subdomains
Export format
.txt
What the index holds.
3.9B tracked names
3,876,668,205 observed DNS names, indexed and searchable.
26.7% end in .com
.com alone covers 1,034,340,253 names — the largest single ending in the index.
30.1% use .com, .net, or .org
.com, .net, and .org cover 1,168,723,629 names combined.
8.7M point to localhost
8,656,874 records resolve to 127.0.0.1, ::1, or localhost.