Subdomain Finder

Find all subdomains of any domain

Enter a domain and instantly list every subdomain that has appeared in public Certificate Transparency logs. Free, no signup, no API key.

Try an example:
  • ◎ Public CT data, no scanning
  • ◎ Instant results
  • ◎ Copy and filter
  • ◎ Flags forgotten hosts

What is a subdomain finder?

A subdomain finder lists every hostname registered under a root domain. If example.com is a website, then api.example.com, staging.example.com and mail.example.com are its subdomains. Most organisations run far more of them than their public site suggests, and the forgotten ones are exactly what an attacker looks for.

This tool works from Certificate Transparency logs: an append-only public record that every browser-trusted TLS certificate must appear in before it can be issued. That makes it the most reliable public source of subdomain names available, and it means the same results are available to security researchers, your competitors, and anyone else who thinks to look.

How to use it

  1. Type a root domain such as example.com above and press Find.
  2. Review the full list of subdomains that appear in public CT logs.
  3. Use the filter, or the check me badge, to surface hosts likely to be dev, staging or admin systems.
  4. Check each one. Remove DNS records for hosts you have retired.

What to do with the results

The interesting findings are almost always the boring-looking ones. Subdomains with names like dev, old, staging, v1 and admin frequently outlive the team that created them, and a host that is still running an old stack of software behind an unmaintained admin panel is a real risk.

For a fuller treatment of what these names mean and how to respond, see the subdomain glossary.

How it works

Before a publicly trusted certificate can be issued, its domain names are submitted to a set of public logs. Those logs are append-only, which is what makes them trustworthy and also why they are never pruned: a hostname appears the moment a certificate covering it is requested, and stays listed even after the host is deleted.

That is the core reason a CT-based finder is so good at surfacing forgotten infrastructure, and also the reason you will sometimes see hosts that no longer resolve. Read more in how subdomain discovery works.

Related questions

Looking for the meaning of a specific hostname? Try the glossary of common subdomain names. Have a question about legality, accuracy or removal? See the FAQ.