Subdomain Finder

The Subdomain Finder discovers subdomains for any public domain by querying Certificate Transparency (CT) logs. Every time an SSL/TLS certificate is issued for a hostname, it's recorded in public CT logs that anyone can search. This makes it possible to enumerate a domain's attack surface — including internal-sounding subdomains like `staging`, `admin`, `internal`, `vpn` or `backup` — without ever sending a packet to the target's infrastructure.

Security researchers, bug bounty hunters, penetration testers, red teams and asset-management engineers use subdomain enumeration to build a complete inventory of a target's public assets. Even blue teams run these searches against their own domain regularly, to catch shadow IT and forgotten certificates issued by former vendors. Because CT queries are passive, this technique is safe for authorized reconnaissance and doesn't tip off the target.

Not every subdomain in CT logs is still live — certificates from years ago may reference systems that were retired long ago. Combine this tool with our DNS Lookup and Domain to IP tools to verify which subdomains actually resolve today, and with SSL Checker to confirm the current certificate posture of each host.