Subdomain Finder
Discover subdomains for any domain from public Certificate Transparency logs - including forgotten staging, dev, admin and API hosts. Free, no signup.
CT-log discovery
Pulls every hostname ever issued a certificate from public transparency logs.
SAN extraction
Expands Subject Alternative Names and wildcards into the full host list.
Risk flags
Highlights suspicious or unexpected subdomains and unusual issuing CAs.
Passive & safe
Uses public logs only - no brute-forcing or traffic to your servers.
FAQ
How does Certificate Transparency find subdomains?
Every TLS certificate issued by a public CA is logged to append-only Certificate Transparency logs. Because certificates name the hosts they cover, those logs reveal subdomains - even ones not linked anywhere public.
Will this find every subdomain?
It finds every subdomain that was ever issued a publicly-trusted certificate. Hosts behind internal CAs or with no certificate won't appear - but CT logs catch the vast majority of internet-facing subdomains.
Why do forgotten subdomains matter?
Stale staging., dev. or old. hosts often run outdated software or point at de-provisioned cloud resources, making them prime targets for takeover. Discovering them is the first step to securing them.
More domain and infrastructure tools
Certificate Transparency Checker
Monitor CT logs for SSL certificate issuance and unauthorized certificates.
WHOIS Lookup
Look up domain registration, registrar and nameserver details.
DNS Lookup
Look up A, AAAA, MX, TXT, NS and other DNS records for any domain.
Web Misconfiguration Scanner
Find exposed config files, .env files, backups and admin panels.
IIS Scanner
Scan Microsoft IIS servers for vulnerabilities and known CVEs.
This is one layer of the scan
FreeThis Subdomain Finder scan covers one category. A full scan adds the checks it does not reach: exposed secrets, malicious scripts, and supply chain risks in your third-party code.