PugRecon
Find exposed names fast enough to use during live research.
Search subdomains and public cloud buckets, then export clean name lists for scanners, notes, and reports.
01
Search in, names out.
Domain or subdomain
example.com
Run query
Export
pugrecon_subdomains_example.com.txt
02
API keys stay close to the work.
Free plan
50 credits per month
Free result cap
30 subdomains
Export format
.txt
03
Corpus context before you search.
3.7B tracked names
The current index contains 3,698,091,195 observed DNS names available for search.
25.7% end in .com
.com accounts for 951,722,774 tracked names, making it the largest familiar ending in the dataset.
29.1% use .com, .net, or .org
Together, those three endings cover 1,074,991,395 tracked names.
8.5M point to localhost
The DNS value index includes 8,512,239 records pointing at 127.0.0.1, ::1, or localhost.