Subdomain Finder

Discover subdomains for any domain from public Certificate Transparency logs - including forgotten staging, dev, admin and API hosts. Free, no signup.

https://

No credit card required • Instant results

CT-log discovery

Pulls every hostname ever issued a certificate from public transparency logs.

SAN extraction

Expands Subject Alternative Names and wildcards into the full host list.

Risk flags

Highlights suspicious or unexpected subdomains and unusual issuing CAs.

Passive & safe

Uses public logs only - no brute-forcing or traffic to your servers.

FAQ

How does Certificate Transparency find subdomains?

Every TLS certificate issued by a public CA is logged to append-only Certificate Transparency logs. Because certificates name the hosts they cover, those logs reveal subdomains - even ones not linked anywhere public.

Will this find every subdomain?

It finds every subdomain that was ever issued a publicly-trusted certificate. Hosts behind internal CAs or with no certificate won't appear - but CT logs catch the vast majority of internet-facing subdomains.

Why do forgotten subdomains matter?

Stale staging., dev. or old. hosts often run outdated software or point at de-provisioned cloud resources, making them prime targets for takeover. Discovering them is the first step to securing them.

This is one check. A full scan runs them all.

Free

The Subdomain Finder covers one area. A full scan runs every check on the same site in one go, so nothing it does not reach goes unnoticed.

Covered by this check

  • Certificate Transparency subdomain discovery
  • SAN & wildcard extraction
  • Suspicious subdomain flagging
  • Issuing CA visibility

Added by a full scan

  • SSL certificate validation
  • Security headers analysis
  • Vulnerability scanning
  • DNS & Email security
  • Domain reputation checks
  • Misconfiguration detection
  • Continuous monitoring
  • Email alerts on new subdomains
https://

Want it checked automatically? A free account rescans one site every week and emails you new findings. No credit card.

Start free monitoring

More domain and infrastructure tools

Certificate Transparency Checker

Monitor CT logs for SSL certificate issuance and unauthorized certificates.

WHOIS Lookup

Look up domain registration, registrar and nameserver details.

DNS Lookup

Look up A, AAAA, MX, TXT, NS and other DNS records for any domain.

Web Misconfiguration Scanner

Find exposed config files, .env files, backups and admin panels.

IIS Scanner

Scan Microsoft IIS servers for vulnerabilities and known CVEs.