Free tool

Subdomain Finder

Discover subdomains from public certificate transparency logs: the same first step an attacker takes to map your attack surface.

Read-only and passive. We only query public records: no login, no port scanning, no exploitation.

What this checks

Searches public Certificate Transparency logs through crt.sh, with Cert Spotter as a backup when crt.sh is slow, for every certificate issued to your domain or its subdomains.
Extracts the hostnames listed on those certificates.
Removes wildcard prefixes and duplicates, keeping only names under your domain.
Returns a sorted list and a count.

Why it matters

Every publicly trusted certificate is recorded in open Certificate Transparency logs, so anyone can list the subdomains you have ever secured. Attackers use exactly this to find forgotten test sites, old webmail, staging copies and admin panels that are no longer patched. Seeing the same list helps you find and retire services you did not know were still visible.

How to read the result

A name appearing here means a certificate was issued for it at some point. It may no longer resolve or be online.
Look for names that suggest test, staging, dev, old, admin or backup systems. These are the ones most likely to be unmaintained.
Subdomains that never had a certificate, or that only use a wildcard certificate, will not show up individually.
Names from a third party you use, such as a hosted shop or helpdesk, can appear if they were issued under your domain.

How to fix what it finds

Check each unexpected subdomain: if it resolves, find the owner and decide whether it should still exist.
Shut down or password protect staging and test sites, and delete their DNS records when they are retired.
Remove DNS records that point to cloud services you no longer use, to prevent a subdomain takeover by someone claiming the resource.
Keep a simple inventory of live subdomains and who is responsible for each.

Want it fixed for you, or tested properly? See what a test would cost or book a free 30 minute call.

Questions people ask

How do I find all subdomains of a website?

Certificate Transparency logs are a reliable passive source, and this tool searches them for you. A complete picture also needs your own DNS zone, since subdomains without certificates are not logged.

Can I hide subdomains from Certificate Transparency?

Not for publicly trusted certificates, because logging is required for browsers to accept them. A wildcard certificate avoids listing individual names, but security through hiding is weak; it is better to secure or remove the service.

What is a subdomain takeover?

It happens when a DNS record still points to a cloud resource, such as a hosting app or storage bucket, that has been deleted. Someone else can claim that resource and serve content on your subdomain.