Waiting
Enter a domain and run discovery to see results.
Subdomain Finder
Discover subdomains of any domain from Certificate Transparency logs. Passive recon that finds forgotten dev/staging hosts. Free, no sign-up.
Detected
Discovered Subdomains
—
JSON
—
Tool Features
Related Tools
Coming Soon New subdomains: the new-host alert in monitoring (Starter and up) tells you.
Subdomain Discovery from Certificate Transparency Logs
Enumerate the subdomains of any domain using Certificate Transparency (CT) logs — the public record of every TLS certificate ever issued. This is passive reconnaissance: no packets are sent to the target. Operational names like dev, staging, admin or vpn are flagged, because forgotten subdomains are a common attack surface and takeover path.
How It Works
Every certificate issued for a domain or its subdomains is logged publicly in CT logs (the same system browsers rely on). The tool queries crt.sh, with Cert Spotter as a fallback, deduplicates the hostnames seen in certificates for the domain (up to 200 names), marks wildcard certificates and highlights operational-looking names worth reviewing.
FAQ
Is this active scanning?
No. CT-log enumeration is fully passive — the information comes from public certificate logs, and no request of any kind is sent to the target domain or its servers. Anyone on the internet can see the same data.
Why do forgotten subdomains matter?
A subdomain that points at a deprovisioned cloud resource (dangling DNS) can sometimes be claimed by an attacker — a subdomain takeover. Old dev/staging hosts also tend to run outdated software. Reviewing what exists is the first step of shrinking your attack surface.
Why does my domain show subdomains I never created?
CT logs record certificates, not DNS. Hosting providers and CDNs sometimes issue certificates covering service hostnames under your domain, and historical certificates remain in the logs even after the subdomain is gone. Check whether each name still resolves.