Subdomain Finder

Discover subdomains from public certificate transparency logs: the same first step an attacker takes to map your attack surface.

Read-only and passive. We only query public records: no login, no port scanning, no exploitation.