Enter domain
Enter the domain to enumerate (e.g. example.com).
DNS & NETWORK TOOLS · FREE ONLINE TOOL
Subdomain Finder
Discover subdomains of any domain from public certificate logsEvery TLS certificate ever issued for a domain is written into public logs, creating a map most site owners have never seen. This finder searches Certificate Transparency logs and returns the subdomain list.
// SUBDOMAIN FINDER · GET STARTED
Use Subdomain Finder
Discover subdomains of any domain from public certificate logs
Advertisement
Advertisement
How to use the Subdomain Finder
Search logs
Click "Find Subdomains" to search Certificate Transparency logs.
Review list
Review the total count and the sorted list of discovered subdomains.
// SUBDOMAIN FINDER · ABOUT THIS TOOL
About the Subdomain Finder
Every TLS certificate issued by a certificate authority is published to public Certificate Transparency logs. The Subdomain Finder searches those logs for your target domain, strips wildcard prefixes, removes duplicates, and returns a sorted list of real, historically observed subdomains. Security researchers use it to map attack surfaces, SEOs to inventory competitors, and site owners to audit forgotten subdomains. Follow up with the SSL Certificate Checker or DNS Lookup to inspect anything you find.
Where it helps most
Three groups rely on this daily.
Security research
Researchers map a target's attack surface during authorized audits, because forgotten subdomains are where vulnerabilities hide.
Competitor inventory
SEOs discover regional sites, documentation portals and product subdomains that reveal competitive strategy.
Own-estate audits
Site owners find subdomains that still resolve but nobody maintains, a security risk and a branding liability.
Annual hygiene
Run it on your own domains at least once a year; you may be surprised what is still out there.
How it works
Passive by design.
Certificate logs
The tool queries crt.sh, the public Certificate Transparency search engine, for every certificate issued for the domain.
Clean list
Names are extracted from each certificate, wildcard prefixes stripped, duplicates removed, up to 200 sorted results.
Fully passive
No probing, no brute force, no packets sent to the target: it only reads public log data.
Subdomain Finder: built for trust
Completely passive lookup of public log data. No signup, results in seconds.
Subdomain Finder FAQs
It queries crt.sh, a public Certificate Transparency log search engine, for every certificate ever issued for the domain. Each certificate lists the subdomains it covers; the tool extracts, dedupes and sorts those names into a clean list of up to 200.
tools-guide
WHOIS Lookup: Find Out Who Owns Any Domain Instantly
Free WHOIS lookup for any domain. Check the registrar, registration and expiry dates, name servers and the full WHOIS record instantly, no sign-up needed.
Read article →
tools-guide
DNS Lookup: Free Online DNS Record Checker for Any Domain
Free online DNS lookup tool. Check A, AAAA, MX, TXT, CNAME, NS and SOA records for any domain instantly. Fast, private, accurate, no sign-up required.
Read article →