Subdomain Finder

Every public SSL certificate is recorded in Certificate Transparency logs, and certificates name the hosts they cover. This finder searches those logs for a domain's subdomains, adds a set of common names found in DNS, and resolves each one to show whether it is still live. It is passive: it reads public logs and DNS and never touches the target website.

How to use Subdomain Finder

1. Enter a domain name, such as example.com.
2. Click Find subdomains. Big domains can take up to half a minute.
3. Review the live subdomains first, then the ones that no longer resolve.

When it comes in handy

• Auditing your own organisation's forgotten staging, test and admin hosts.
• Finding dangling subdomains that could be taken over.
• Mapping a site's services during an authorised security assessment.

Frequently asked questions

Why are some subdomains missing?

Only hosts that appeared on a certificate or match a common name are found. Hosts covered by a wildcard certificate (*.example.com) and internal-only names do not show up.

Is it legal to look up subdomains?

Yes, the data is public. Scanning or attacking the hosts you find without permission is not; only test systems you own or are authorised to test.