Subdomain Finder

Discover subdomains from certificate transparency logs.

Free & unlimited

Third-party data source

Subdomain discovery queries crt.sh (certificate transparency logs) via our backend. The domain you enter is sent to crt.sh. Only public CT log data is returned.

Try:

Processed on our servers and deleted right after. Never stored or shared.

About this tool

1
Enter a domain
Type a root domain like example.com to discover its subdomains.
2
Start enumeration
The tool queries DNS records, certificate transparency logs, and other sources.
3
Review discovered subdomains
Browse the list of found subdomains with their IP addresses and status.
4
Export results
Download the subdomain list as a CSV or text file for further analysis.

Certificate transparency logs are a rich source - they reveal subdomains with SSL certificates issued.
Look for staging, dev, or test subdomains that may have weaker security configurations.
Combine results with a port checker to identify services running on discovered subdomains.
Not all subdomains are public-facing - some may resolve to internal IPs.

Queries certificate transparency logs for comprehensive coverage
DNS brute-force with common subdomain wordlists
Shows IP address and HTTP status for each subdomain
Exportable results in CSV format
Identifies wildcard DNS configurations

Map the attack surface of your own domain for a security audit.
Discover forgotten or undocumented subdomains that may need updates or decommissioning.
Research a company's public infrastructure during competitive analysis.
Prepare for a penetration test by enumerating all accessible entry points.

Querying public DNS records and certificate logs is legal. However, always ensure you have authorization before performing security testing on discovered subdomains.

Subdomains without public DNS records or SSL certificates may not appear. Internal-only subdomains are typically not discoverable from external sources.